60b95287bdd433e9754b04876bf2422c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

60b95287bdd433e9754b04876bf2422c_JaffaCakes118
Size

2.9MB
MD5

60b95287bdd433e9754b04876bf2422c
SHA1

23cd7a9042dc64261f5c30e0f961c84a376e5801
SHA256

048b6d5b35de2ba7af5f36d68714a7500733b077aed3c915470ad6c77ba32ed4
SHA512

a1c77e5307994c843d16f918420550773a7ef9f3f3eacfcdd9575bb6fc83d7ffe584f83104d2bf547d5328ec9af927221e1a19102f5b9e3e66852e9dcbf14eb9
SSDEEP

49152:WKKLTRQj/ghm1Yq3WLh7s8ntsZWa4oRBNz7KHTjUK5knjwizdWUmKshz6TPe:Wf3M/Nah7/HaVRXK7Kj9BWUdZTPe

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.lxp.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.lxp.dll	upx
static1/unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/u3/wtd.exe	upx

Unsigned PE 63 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/HovercamDetect.exe
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/SARCKbdHook64.dll
unpack002/$PLUGINSDIR/lua51.dll
unpack002/$PLUGINSDIR/luahost.dll
unpack002/$PLUGINSDIR/luawin.dll
unpack002/$PLUGINSDIR/serotek.lua51.bit.dll
unpack002/$PLUGINSDIR/serotek.lua51.lfs.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/dummycf.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/libexpat.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/libjpeg.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/lua5.1.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/lua51.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/luacom13.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/luahost.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/luawin.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/mpaudec.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/mpaudec.pyd
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/ogg.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/pcre.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.atlhostex.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.base64.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.bit.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.bz2.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.c-stcommon.hostinfo.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.c-stcommon.process.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.host.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.lfs.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.lpeg.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.lxp.dll
unpack005/out.upx
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.md5.core.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.mime.core.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.mpaudec.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.pack.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.polarssl.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.random.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.rbdhid.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.rex_pcre.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.sapi4.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.socket.core.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.codesign.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.mmhook.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.rc.kbdhook.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.rc.shutdown.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.shfredir.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.tones.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.windows.interdesk.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stmag.gdi.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stmag.magapi.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stmag.null.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stscan.camera.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stscan.twain.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.unicode.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.vorbisfile.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.waveout.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.zip.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/shfredir.dll
unpack006/host/procmgr.exe
unpack007/out.upx
unpack008/$PLUGINSDIR/UserInfo.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/vorbis.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/vorbisfile.dll
unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/woemu.dll

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/uninst.exe	nsis_installer_1
static1/unpack001/$LOCALAPPDATA/System Access to Go/SAWebStart/uninst.exe	nsis_installer_2

Files

60b95287bdd433e9754b04876bf2422c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

13:4b:0a:06:63:ae:fe:a1:67:22:12:d9:c2:0a:37:7a:84:1b:e5:eb
Signer

Actual PE Digest

13:4b:0a:06:63:ae:fe:a1:67:22:12:d9:c2:0a:37:7a:84:1b:e5:eb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/DocuscanPlus.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

46:45:ce:d7:db:d5:87:80:32:c8:f9:c0:d1:b4:f6:92:71:74:c2:2c
Signer

Actual PE Digest

46:45:ce:d7:db:d5:87:80:32:c8:f9:c0:d1:b4:f6:92:71:74:c2:2c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 6KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/FBRCKbdHook.dll
.dll windows:5 windows x86 arch:x86

12b063f0d89b324ad175d8c294462144

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c9:3c:dc:be:b9:3f:a2:00:ca:e8:ac:16:62:85:e8:5a:b9:ea:d1:c6
Signer

Actual PE Digest

c9:3c:dc:be:b9:3f:a2:00:ca:e8:ac:16:62:85:e8:5a:b9:ea:d1:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\rchook\FBRCKbdHook.pdb

Imports

user32

SetWindowsHookExA
CallNextHookEx
UnhookWindowsHookEx

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
_except_handler3
strrchr
_stricmp

kernel32

GetLastError
SetLastError
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
RtlUnwind
Sleep

ntdll

NtProtectVirtualMemory
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrGetDllHandle
LdrLoadDll
NtSetSystemInformation

Exports

Exports

GetMsgProc
InstallFBRCKbdHook
RemoveFBRCKbdHook

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/HovercamDetect.exe
.exe windows:5 windows x86 arch:x86

362cc361578d2309461a0b9f4948338c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\VCWork\HovercamDetectOnlyT\Release\HovercamDetect.pdb

Imports

kernel32

GetVersionExA
WideCharToMultiByte
FlushFileBuffers
CloseHandle
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
GetCommandLineA
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringA
MultiByteToWideChar
LCMapStringW
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
RaiseException

advapi32

RegSetValueExA
RegOpenKeyExA
RegCloseKey

ole32

CoCreateInstance
CoInitialize

oleaut32

SysFreeString

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/SA.exe
.exe windows:5 windows x86 arch:x86

5437997cfb1fd83a90aff93d0b6bab82

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

27:2a:c6:67:d3:a0:fc:1b:5b:dc:94:5c:b7:4a:40:65:9a:76:27:6a
Signer

Actual PE Digest

27:2a:c6:67:d3:a0:fc:1b:5b:dc:94:5c:b7:4a:40:65:9a:76:27:6a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\serotek\sa\bootstrap\sa\SA.pdb

Imports

luawin

luawin_checklwstring
luawin_pushwstring

lua51

lua_insert
luaL_loadbuffer
lua_close
lua_rawseti
lua_gettop
lua_pushboolean
lua_getfield
lua_pushstring
lua_pushinteger
lua_toboolean
lua_pushvalue
lua_remove
lua_call
lua_pcall
lua_type
luaL_checkstack
lua_createtable
luaL_newstate
lua_tolstring
lua_touserdata
lua_gc
lua_cpcall
luaL_register
lua_newuserdata
lua_pushlstring
lua_settop
luaL_openlibs
lua_pushcclosure
lua_setfield
luaL_checklstring
luaL_error

ole32

OleInitialize
OleUninitialize

user32

MessageBoxA

msvcrt

wcsncpy
swprintf
wcsrchr
iswctype
towupper
_wgetenv
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
_wcsicmp
_beginthreadex
free
memcpy
strerror
_errno
__argc
__wargv
wcslen
malloc
strlen
_wputenv
memset

kernel32

WideCharToMultiByte
FindResourceA
SizeofResource
LockResource
GetModuleHandleA
CloseHandle
GetModuleFileNameW
GetVolumeInformationW
RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadResource

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/SABrlDriver.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:ab:f1:ab:94:4c:8f:20:dc:7e:6a:96:0a:ce:60:da:b3:6b:0b:da
Signer

Actual PE Digest

50:ab:f1:ab:94:4c:8f:20:dc:7e:6a:96:0a:ce:60:da:b3:6b:0b:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 5KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SABrowser.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cc:b4:09:14:e4:2f:e9:35:32:4a:fe:32:f0:46:bd:d1:18:b5:6c:f5
Signer

Actual PE Digest

cc:b4:09:14:e4:2f:e9:35:32:4a:fe:32:f0:46:bd:d1:18:b5:6c:f5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 6KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SABrowserHelper.exe
.exe windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ef:7b:db:37:43:44:54:2f:ff:99:16:e9:13:4b:57:af:d1:dd:5e:69
Signer

Actual PE Digest

ef:7b:db:37:43:44:54:2f:ff:99:16:e9:13:4b:57:af:d1:dd:5e:69

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 2KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SAHS.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

27:b1:70:15:3b:5e:12:7e:e6:cb:11:60:e1:33:7b:b8:86:93:51:e4
Signer

Actual PE Digest

27:b1:70:15:3b:5e:12:7e:e6:cb:11:60:e1:33:7b:b8:86:93:51:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 6KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SAHSHelper.exe
.exe windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fd:26:0e:6e:6e:23:a9:b5:ca:1c:9d:4e:75:33:16:4f:e4:aa:cb:fa
Signer

Actual PE Digest

fd:26:0e:6e:6e:23:a9:b5:ca:1c:9d:4e:75:33:16:4f:e4:aa:cb:fa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 2KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SAInstall.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

99:b2:28:b4:f4:c6:83:80:fb:4f:cb:b6:7b:a4:b1:aa:ae:94:8a:51
Signer

Actual PE Digest

99:b2:28:b4:f4:c6:83:80:fb:4f:cb:b6:7b:a4:b1:aa:ae:94:8a:51

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 5KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SALdr32.exe
.exe windows:5 windows x86 arch:x86

3af2416cc6e1d9a1b66e6871cd9f3796

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bb:ac:45:df:75:2f:eb:2f:7a:ac:c6:8a:97:b4:63:82:af:c7:e8:09
Signer

Actual PE Digest

bb:ac:45:df:75:2f:eb:2f:7a:ac:c6:8a:97:b4:63:82:af:c7:e8:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\serotek\sa\inproc\loader\binrel32\SALdr32.pdb

Imports

shell32

ShellExecuteExW

ole32

CoInitialize

user32

DispatchMessageW
DefWindowProcW
PostThreadMessageW
CreateWindowExW
FindWindowExW
IsWindow
PeekMessageW
RegisterClassExW
GetForegroundWindow
TranslateMessage
FindWindowW
MsgWaitForMultipleObjects
PostMessageW
RegisterWindowMessageW
PostQuitMessage
GetMessageW
SetTimer
DestroyWindow
GetWindowThreadProcessId

msvcrt

__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_amsg_exit
?terminate@@YAXXZ
_controlfp
??2@YAPAXI@Z
wcscpy
_assert
wcsrchr
_wgetcwd
wcscat
memcpy
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
memset

kernel32

GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
Sleep
RtlUnwind
RaiseException
LoadLibraryA
InterlockedExchange
FreeLibrary
LocalAlloc
CheckRemoteDebuggerPresent
CloseHandle
GetProcAddress
GetLastError
GetModuleFileNameW
GetExitCodeProcess
LoadLibraryW
OpenProcess
GetTickCount
GetModuleHandleW
ExitProcess

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/SALdr64.exe
.exe windows:5 windows x64 arch:x64

970181eb4b7243d9eb9fbba744d908b7

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9f:6a:15:4c:c1:81:c0:bc:e4:46:c2:43:27:64:48:dd:94:ed:9c:03
Signer

Actual PE Digest

9f:6a:15:4c:c1:81:c0:bc:e4:46:c2:43:27:64:48:dd:94:ed:9c:03

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\serotek\sa\inproc\loader\binrel64\SALdr64.pdb

Imports

ole32

CoInitialize

user32

DispatchMessageW
DefWindowProcW
PostThreadMessageW
CreateWindowExW
IsWindow
RegisterClassExW
GetForegroundWindow
TranslateMessage
FindWindowW
PostMessageW
RegisterWindowMessageW
PostQuitMessage
GetMessageW
SetTimer
DestroyWindow
GetWindowThreadProcessId

msvcrt

_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
__wgetmainargs
?terminate@@YAXXZ
??2@YAPEAX_K@Z
_wgetcwd
wcscat
memcpy
__C_specific_handler

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RaiseException
LoadLibraryA
FreeLibrary
LocalAlloc
Sleep
CheckRemoteDebuggerPresent
CloseHandle
GetProcAddress
GetLastError
LoadLibraryW
OpenProcess
GetModuleHandleW
GetCurrentProcess
ExitProcess
GetCurrentProcessId

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/SARCKbdHook64.dll
.dll windows:5 windows x64 arch:x64

0fd7a79e659914ec0696f8efb9c53fba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

user32

SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx

ntdll

wcsrchr
_wcsicmp
NtSetSystemInformation
NtProtectVirtualMemory
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrGetDllHandle
LdrLoadDll

msvcrt

_XcptFilter
malloc
_initterm
free
_amsg_exit
_stricmp
__C_specific_handler

kernel32

GetCurrentProcess
GetLastError
Sleep
GetModuleFileNameW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError

Exports

Exports

GetMsgProc
InstallFBRCKbdHook
RemoveFBRCKbdHook

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/SARCServer.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

78:ad:bb:33:0f:bb:08:f7:69:39:35:c4:4c:d9:97:fc:f5:f0:95:dc
Signer

Actual PE Digest

78:ad:bb:33:0f:bb:08:f7:69:39:35:c4:4c:d9:97:fc:f5:f0:95:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 6KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SARCWinlogonHelper.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6e:80:97:6b:aa:ad:60:15:69:17:17:b4:36:7a:20:3b:10:bc:bf:89
Signer

Actual PE Digest

6e:80:97:6b:aa:ad:60:15:69:17:17:b4:36:7a:20:3b:10:bc:bf:89

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 5KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SAStartuPCtl.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

56:75:78:24:ed:c7:d2:67:0e:76:af:e2:4c:54:d8:30:ab:ca:33:49
Signer

Actual PE Digest

56:75:78:24:ed:c7:d2:67:0e:76:af:e2:4c:54:d8:30:ab:ca:33:49

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 5KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SATTSHelper.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b7:01:63:de:91:ac:f2:27:ca:2f:38:bf:ed:c7:11:43:df:a8:79:b5
Signer

Actual PE Digest

b7:01:63:de:91:ac:f2:27:ca:2f:38:bf:ed:c7:11:43:df:a8:79:b5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 5KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SAUninstallGlobal.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e0:56:76:1b:a7:cf:e1:4d:64:fb:1c:45:0b:e6:7b:9b:f1:3b:38:1b
Signer

Actual PE Digest

e0:56:76:1b:a7:cf:e1:4d:64:fb:1c:45:0b:e6:7b:9b:f1:3b:38:1b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 5KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SAUninstallUser.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

83:39:36:93:7b:c8:48:65:83:37:31:43:21:ff:c4:8f:53:b7:25:8c
Signer

Actual PE Digest

83:39:36:93:7b:c8:48:65:83:37:31:43:21:ff:c4:8f:53:b7:25:8c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 5KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SAWinlogonCtl.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

14:c5:92:92:1b:98:71:ec:88:c0:cd:d8:b5:23:0a:ea:9d:4c:52:8f
Signer

Actual PE Digest

14:c5:92:92:1b:98:71:ec:88:c0:cd:d8:b5:23:0a:ea:9d:4c:52:8f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 5KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SAWinlogonMaster.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

95:a9:65:ca:cc:bb:2d:f8:98:3e:88:d2:c3:e4:0e:01:c0:2c:12:79
Signer

Actual PE Digest

95:a9:65:ca:cc:bb:2d:f8:98:3e:88:d2:c3:e4:0e:01:c0:2c:12:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 9KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/SAWinlogonMaster/init.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/SAWinlogonMaster/main.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/SAWinlogonSlave.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a3:32:f1:b9:49:51:7e:97:d1:bb:35:53:3d:63:03:48:f0:6c:c0:c6
Signer

Actual PE Digest

a3:32:f1:b9:49:51:7e:97:d1:bb:35:53:3d:63:03:48:f0:6c:c0:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 5KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/STAH32.dll
.dll windows:5 windows x86 arch:x86

a988199d92e2991fd2ccc145f8d4fdac

Code Sign

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

94:31:33:eb:06:64:5c:1b:4a:b7:4e:58:25:2f:eb:8e:8e:53:66:97
Signer

Actual PE Digest

94:31:33:eb:06:64:5c:1b:4a:b7:4e:58:25:2f:eb:8e:8e:53:66:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\audiohook\hookdll\binrel32\STAH32.pdb

Imports

msvcrt

_wcsicmp
??1type_info@@UAE@XZ
??3@YAXPAX@Z
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
memset
memcpy
_except_handler3
_stricmp
realloc
swprintf
strrchr
malloc
free
exit
wcsrchr
_beginthreadex

kernel32

InterlockedIncrement
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
RtlUnwind
RaiseException
LoadLibraryA
InterlockedExchange
FreeLibrary
LocalAlloc
MultiByteToWideChar
ProcessIdToSessionId
CreateFileW
WriteFile
TlsFree
TlsAlloc
GetModuleHandleA
GetModuleFileNameA
TlsSetValue
TlsGetValue
GetCurrentProcessId
GetProcAddress
ResumeThread
CloseHandle
DeleteCriticalSection
OpenEventW
DisableThreadLibraryCalls
EnterCriticalSection
SetLastError
GetLastError
FreeLibraryAndExitThread
GetModuleFileNameW
LeaveCriticalSection
Sleep
LoadLibraryW
InitializeCriticalSection
GetModuleHandleW
WaitForSingleObject
InterlockedDecrement

ntdll

NtQueryInformationThread
NtSetSystemInformation
NtProtectVirtualMemory
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrGetDllHandle
LdrLoadDll
NtReadVirtualMemory
NtQueryInformationProcess
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtClose
NtWaitForSingleObject
NtResumeThread
NtSetInformationThread
RtlCreateUserThread
NtWriteVirtualMemory

Exports

Exports

Attach

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/STAH64.dll
.dll windows:5 windows x64 arch:x64

3f7cf7ad77c593b5d1b6d244d26078df

Code Sign

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

73:cb:57:5e:2d:00:b7:c4:d4:4a:c2:b5:1b:82:ca:10:82:26:34:6f
Signer

Actual PE Digest

73:cb:57:5e:2d:00:b7:c4:d4:4a:c2:b5:1b:82:ca:10:82:26:34:6f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\audiohook\hookdll\binrel64\STAH64.pdb

Imports

msvcrt

??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
_amsg_exit
_initterm
_XcptFilter
memset
memcpy
_stricmp
__C_specific_handler
realloc
swprintf
strrchr
malloc
free
exit
wcsrchr
_beginthreadex
_wcsicmp

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RaiseException
LoadLibraryA
FreeLibrary
LocalAlloc
MultiByteToWideChar
ProcessIdToSessionId
CreateFileW
WriteFile
TlsFree
TlsAlloc
GetModuleHandleA
GetModuleFileNameA
TlsSetValue
TlsGetValue
GetCurrentProcessId
GetProcAddress
ResumeThread
CloseHandle
DeleteCriticalSection
OpenEventW
DisableThreadLibraryCalls
EnterCriticalSection
SetLastError
GetLastError
FreeLibraryAndExitThread
GetModuleFileNameW
LeaveCriticalSection
Sleep
LoadLibraryW
InitializeCriticalSection
GetModuleHandleW
WaitForSingleObject
GetSystemTimeAsFileTime

ntdll

NtQueryInformationThread
NtSetSystemInformation
NtProtectVirtualMemory
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrGetDllHandle
LdrLoadDll
NtReadVirtualMemory
NtQueryInformationProcess
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtClose
NtWaitForSingleObject
NtResumeThread
NtSetInformationThread
RtlCreateUserThread
NtWriteVirtualMemory
RtlEncodeSystemPointer
NtQueueApcThread

Exports

Exports

Attach

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 386B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/STAHL32.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

53:21:85:db:85:cc:86:6e:6f:f7:9a:3c:01:4f:d7:31:a7:09:84:46
Signer

Actual PE Digest

53:21:85:db:85:cc:86:6e:6f:f7:9a:3c:01:4f:d7:31:a7:09:84:46

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 10KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/STAHL64.exe
.exe windows:5 windows x64 arch:x64

dc060669d076c5519e8602a743822567

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9a:82:20:b2:01:ea:6d:01:c3:01:bf:45:4b:e8:e3:d0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

02/12/2009, 00:00

Not After

02/12/2010, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:a8:ea:32:cd:78:34:e2:fb:0a:0e:b3:e0:d4:35:f9:be:09:21:49
Signer

Actual PE Digest

0d:a8:ea:32:cd:78:34:e2:fb:0a:0e:b3:e0:d4:35:f9:be:09:21:49

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\serotek\sa\audiohook\loaderexe\binrel64\STAHL64.pdb

Imports

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

psapi

GetProcessImageFileNameW
EnumProcesses

msvcrt

_exit
_cexit
exit
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_XcptFilter
memset
__C_specific_handler
memcpy
malloc
_wcsicmp
_iob
wcsrchr
free
fwprintf
swprintf
__wgetmainargs

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Module32NextW
CreateToolhelp32Snapshot
Module32FirstW
CreateThread
CreateEventW
SetThreadPriority
GetModuleFileNameW
OpenProcess
SetEvent
WaitForSingleObject
PulseEvent
GetCurrentProcessId
CloseHandle
ProcessIdToSessionId
GetProcAddress
CreateFileW
Sleep
LoadLibraryW
GetModuleHandleW

ntdll

NtAllocateVirtualMemory
NtFreeVirtualMemory
NtClose
NtQueryInformationThread
NtWaitForSingleObject
NtResumeThread
NtSetInformationThread
RtlCreateUserThread
NtWriteVirtualMemory
NtReadVirtualMemory
NtProtectVirtualMemory
RtlEncodeSystemPointer
NtQueueApcThread
LdrGetDllHandle
NtQueryInformationProcess

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/dlfilemgr.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/download.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/filemgr.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/hsmgr.wlua
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/install.wlua
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/makekey.wlua
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/medialib.wlua
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/pdsync.wlua
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/progpack.wlua
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/scan.wlua
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/ssca.wlua
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/tts.wlua
$LOCALAPPDATA/System Access to Go/SAWebStart/apps/updater.wlua
$LOCALAPPDATA/System Access to Go/SAWebStart/atlhostex.dll
.dll windows:5 windows x86 arch:x86

2ba119e5bd8fdb9f832b51df23f27228

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

47:ed:0a:4f:c2:3f:60:ed:8a:1a:b0:c5:3c:c3:ea:c7:40:30:dd:7e
Signer

Actual PE Digest

47:ed:0a:4f:c2:3f:60:ed:8a:1a:b0:c5:3c:c3:ea:c7:40:30:dd:7e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\atlhostex\atlhostex.pdb

Imports

gdi32

CreateSolidBrush
GetStockObject
GetObjectA
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteObject
GetDeviceCaps
DeleteDC
BitBlt

kernel32

lstrcmpA
lstrlenA
InterlockedIncrement
InterlockedDecrement
GetCurrentProcess
InitializeCriticalSection
HeapDestroy
LeaveCriticalSection
MultiByteToWideChar
lstrlenW
FlushInstructionCache
RaiseException
SetLastError
EnterCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
GetCurrentThreadId
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetSystemTimeAsFileTime

user32

GetClientRect
wsprintfA
InvalidateRgn
GetParent
GetFocus
SetCapture
SetFocus
IsChild
FillRect
BeginPaint
GetClassNameA
DestroyWindow
EndPaint
GetClassInfoExA
SendMessageA
GetWindow
LoadCursorA
CallWindowProcA
ReleaseCapture
CreateWindowExA
GetDC
SetWindowLongA
InvalidateRect
CreateAcceleratorTableA
RegisterClassExA
GetWindowLongA
SetWindowPos
GetSysColor
GetDesktopWindow
RedrawWindow
DefWindowProcA
GetDlgItem
ReleaseDC
IsWindow

olepro32

ord253

ole32

CLSIDFromProgID
OleLockRunning
CoCreateInstance
CLSIDFromString

oleaut32

SysFreeString
VariantClear
SysStringLen
SysAllocString
LoadRegTypeLi

msvcrt

??_U@YAPAXI@Z
??_V@YAXPAX@Z
??3@YAXPAX@Z
??1type_info@@UAE@XZ
_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
??2@YAPAXI@Z

Exports

Exports

AtlAxCreateHost

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/bc6/LaunchSA.exe
.exe windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a7:68:d0:60:98:f6:81:86:f5:5b:02:4a:6c:4f:7b:a0:36:5f:15:89
Signer

Actual PE Digest

a7:68:d0:60:98:f6:81:86:f5:5b:02:4a:6c:4f:7b:a0:36:5f:15:89

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 18KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/SALauncher.exe
.exe windows:5 windows x86 arch:x86

b770e5417b0f5deb52c9769809fc3ab0

Code Sign

a0:c7:ef:3f:f8:19:a0:f6:33:08:9b:ad:b9:4c:22:d8
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/11/2007, 00:00

Not After

24/11/2008, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:7a:47:15:00:63:6b:8f:33:8e:1f:53:59:7c:a2:d8:5c:af:78:fd
Signer

Actual PE Digest

30:7a:47:15:00:63:6b:8f:33:8e:1f:53:59:7c:a2:d8:5c:af:78:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

luahost

luahost_newstate
luahost_message
luahost_report
luahost_close
luahost_initstate
luahost_domainresource
luahost_registercmodules
luahost_setstateinitfunction

luawin

luawin_checklwstring

lua51

lua_cpcall
lua_touserdata
lua_gc
lua_settop
luaL_checklstring
lua_newuserdata
lua_pushlstring
luaL_openlibs
lua_pushcclosure
lua_setfield

msvcrt

__getmainargs
_cexit
_exit
_XcptFilter
exit
_acmdln
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
_ismbblead
__argv
__argc
_wputenv
_amsg_exit

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/lua/luawin.lua
$PLUGINSDIR/lua/stcommon/cotask.lua
$PLUGINSDIR/lua/stcommon/delay.lua
$PLUGINSDIR/lua/stcommon/dict.lua
$PLUGINSDIR/lua/stcommon/kbdcon.lua
$PLUGINSDIR/lua/stcommon/localize.lua
$PLUGINSDIR/lua/stcommon/log.lua
$PLUGINSDIR/lua/stcommon/object.lua
$PLUGINSDIR/lua/stcommon/strutil.lua
$PLUGINSDIR/lua/stcommon/usbstor.lua
$PLUGINSDIR/lua/stcommon/util/comutil.lua
$PLUGINSDIR/lua/stcommon/util/envtable.lua
$PLUGINSDIR/lua/stcommon/util/set.lua
$PLUGINSDIR/lua/stcommon/util/tempfile.lua
$PLUGINSDIR/lua/stcommon/util/u3.lua
$PLUGINSDIR/lua/stcommon/util/ubase64.lua
$PLUGINSDIR/lua/stcommon/util/ziputil.lua
$PLUGINSDIR/lua/stcommon/windows/init.lua
$PLUGINSDIR/lua/stcommon/windows/msgloop.lua
$PLUGINSDIR/lua51.dll
.dll windows:5 windows x86 arch:x86

c7181b74a0434fca56edc1ccf9741f64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\lua\lua51\bin32\lua51.pdb

Imports

msvcrt

fflush
iscntrl
localeconv
isalnum
isdigit
isalpha
fabs
sin
sinh
cos
cosh
tan
tanh
asin
acos
atan
atan2
ceil
fmod
modf
sqrt
log
log10
exp
frexp
ldexp
rand
srand
_HUGE
strrchr
strtod
sprintf
strncat
strcspn
strcat
strcpy
strncpy
tmpnam
clock
localtime
gmtime
time
mktime
difftime
setlocale
memcmp
tolower
toupper
isupper
isxdigit
ispunct
islower
memchr
strpbrk
strcoll
setvbuf
_wfopen
_wpopen
_strdup
malloc
_wgetenv
_wsystem
_wremove
_wrename
wcsftime
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
fseek
ftell
fwrite
clearerr
fscanf
tmpfile
_pclose
longjmp
exit
_setjmp3
fgets
floor
pow
abs
strtoul
isspace
fputs
strstr
strcmp
fprintf
free
realloc
_iob
getc
freopen
ungetc
ferror
fclose
_errno
strerror
feof
fread
memcpy
strchr
strlen

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
SetLastError
GetModuleFileNameW
GetVersion
GetProcAddress
FreeLibrary
GetLastError
FormatMessageA
GetModuleHandleW
GetSystemTimeAsFileTime

Exports

Exports

luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmainthread
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlevel
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/luahost.dll
.dll windows:5 windows x86 arch:x86

af03692b29fe19ec6109d5a231968d0c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

lua_cpcall
lua_touserdata
lua_close
luaL_newstate
lua_error
lua_setfield
luaL_error
lua_pushlstring
luaL_loadbuffer
luaL_loadfile
luaL_checkstack
lua_pushstring
lua_createtable
lua_gettop
lua_pushcclosure
lua_insert
lua_pcall
lua_remove
lua_gc
lua_getfield
lua_pushvalue
lua_pushinteger
lua_call
lua_type
lua_tolstring
lua_settop
lua_rawseti
luaL_openlibs

ole32

OleInitialize
OleUninitialize

user32

MessageBoxA

msvcrt

_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
malloc
_errno
memcpy
_beginthreadex
free
strlen

kernel32

LockResource
LoadResource
FindResourceA
GetModuleHandleA
CloseHandle
RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
SizeofResource
GetTickCount

Exports

Exports

luahost_callmain
luahost_close
luahost_dobuffer
luahost_dofile
luahost_domainbuffer
luahost_domainresource
luahost_doresource
luahost_dostring
luahost_getargs
luahost_getpreload
luahost_initstate
luahost_loadresource
luahost_message
luahost_newstate
luahost_openlibs
luahost_pcall
luahost_registercmodules
luahost_registerluachunkresources
luahost_registerluachunks
luahost_registerluamoduleresources
luahost_registerluamodules
luahost_report
luahost_setstateinitfunction
luahost_starttask

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/luawin.dll
.dll windows:5 windows x86 arch:x86

2a1c48e25b0ff214839762e3b63323cf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\lua\luawin\bin32\luawin.pdb

Imports

lua51

lua_getallocf
luaL_optlstring
lua_tointeger
luaL_buffinit
luaL_addlstring
luaL_addvalue
luaL_pushresult
lua_setfield
lua_getmetatable
luaL_optnumber
luaL_ref
lua_pcall
lua_cpcall
lua_tolstring
luaL_unref
lua_isuserdata
lua_error
lua_pushboolean
lua_setfenv
lua_getmainthread
lua_newthread
lua_getfenv
lua_toboolean
luaL_optinteger
luaL_checkinteger
lua_rawseti
lua_call
lua_createtable
lua_pushinteger
lua_getfield
lua_gettable
lua_touserdata
lua_pushstring
lua_settable
lua_setmetatable
lua_pushlightuserdata
lua_rawset
lua_insert
lua_concat
lua_pushvalue
lua_rawget
lua_pushfstring
luaL_checknumber
luaL_checktype
luaL_error
lua_isnumber
lua_pushnumber
lua_tonumber
luaL_openlib
luaL_argerror
lua_isstring
lua_settop
lua_gettop
lua_objlen
lua_rawgeti
lua_type
luaL_checklstring
lua_pushnil
lua_pushlstring
lua_newuserdata
lua_remove
lua_pushcclosure

msvcrt

_adjust_fdiv
_initterm
_XcptFilter
free
malloc
??1type_info@@UAE@XZ
wcslen
_wcsicmp
labs
wcsncpy
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
_iob
fprintf
memcmp
memcpy
strlen
_amsg_exit

kernel32

CloseHandle
InterlockedDecrement
InterlockedIncrement
GetLastError
FormatMessageA
LocalFree
GetCurrentProcessId
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
LoadLibraryW
Beep
Sleep
GetLogicalDriveStringsW
GetDriveTypeW
SetVolumeLabelW
GetVolumeInformationW
GetModuleHandleW
GetModuleFileNameW
GetTempPathW
MoveFileExW
GetTempFileNameW
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
CopyFileW
GetCurrentDirectoryW
GetVersion
GetEnvironmentVariableW
CreateMutexW
OpenMutexW
OpenProcess
TerminateProcess
GetShortPathNameW
GetLongPathNameW
ProcessIdToSessionId
CreateEventW
OpenEventW
WaitForSingleObject
WaitForMultipleObjects
GetExitCodeProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateProcessW
ReleaseMutex
GetDiskFreeSpaceExW
GetCurrentProcess
GetSystemPowerStatus
GetSystemDirectoryW
ReadFile
CreateMailslotW
GetMailslotInfo
GetLocaleInfoW
GetThreadLocale
GlobalUnlock
GlobalLock
GlobalAlloc
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
RtlUnwind
RaiseException
LoadLibraryA
InterlockedExchange
LocalAlloc
FreeLibrary

Exports

Exports

??0luawin_Gateway_IUnknown@@QAE@ABV0@@Z
??0luawin_Gateway_IUnknown@@QAE@PAUlua_State@@HPAUIUnknown@@@Z
??1luawin_Gateway_IUnknown@@MAE@XZ
??4luawin_Gateway_IUnknown@@QAEAAV0@ABV0@@Z
??_7luawin_Gateway_IUnknown@@6B@
?AddRef@luawin_Gateway_IUnknown@@UAGKXZ
?QueryInterface@luawin_Gateway_IUnknown@@UAGJABU_GUID@@PAPAX@Z
?Release@luawin_Gateway_IUnknown@@UAGKXZ
luaopen_atl
luaopen_cfgmgr
luaopen_combridge
luaopen_commctrl
luaopen_dbt
luaopen_docobj
luaopen_downloadmgr
luaopen_dwmapi
luaopen_mmsystem
luaopen_msctf
luaopen_mshtml
luaopen_objbase
luaopen_ole
luaopen_ole2
luaopen_oleacc
luaopen_oleauto
luaopen_olectl
luaopen_psapi
luaopen_sensapi
luaopen_servprov
luaopen_sfc
luaopen_shdocvw
luaopen_shellapi
luaopen_shlobj
luaopen_shlwapi
luaopen_textserv
luaopen_textstor
luaopen_tom
luaopen_urlhist
luaopen_urlmon
luaopen_winbase
luaopen_windef
luaopen_winerror
luaopen_wingdi
luaopen_winhttp
luaopen_wininet
luaopen_winnls
luaopen_winnt
luaopen_winreg
luaopen_winuser
luaopen_winver
luaopen_wtsapi
luaopen_wtypes
luawin_checkIBindCtx
luawin_checkIBindStatusCallback
luawin_checkIClassFactory
luawin_checkIDispatch
luawin_checkIDocHostUIHandler
luawin_checkIDownloadManager
luawin_checkIHttpNegotiate
luawin_checkIMoniker
luawin_checkINewWindowManager
luawin_checkIOleCommandTarget
luawin_checkISequentialStream
luawin_checkIServiceProvider
luawin_checkIStream
luawin_checkaresourceid
luawin_checkastringarray
luawin_checkastringoratom
luawin_checkatom
luawin_checkbstr
luawin_checkcolorref
luawin_checkcomobject
luawin_checkguid
luawin_checkhandle
luawin_checkhandlelist
luawin_checkhbitmap
luawin_checkhcursor
luawin_checkhdc
luawin_checkhdesk
luawin_checkhgdiobj
luawin_checkhicon
luawin_checkhkey
luawin_checkhmenu
luawin_checkhmodule
luawin_checkhr
luawin_checkhtreeitem
luawin_checkhwinsta
luawin_checkhwnd
luawin_checkiid
luawin_checkkbdstate
luawin_checklastring
luawin_checklwstring
luawin_checkmsg
luawin_checkobject
luawin_checkobjectex
luawin_checkpaintstruct
luawin_checkpoint
luawin_checkrect
luawin_checksize
luawin_checkunsigned
luawin_checkvariant
luawin_checkwresourceid
luawin_checkwstringarray
luawin_checkwstringoratom
luawin_disownhdesk
luawin_disownhmenu
luawin_disownhmodule
luawin_disownhwinsta
luawin_error
luawin_error_code
luawin_freeboxedbstr
luawin_gatewaymethod
luawin_gatewaymethodcall
luawin_gatewaymethodimplsetup
luawin_initatomtype
luawin_initcachetable
luawin_initcolorreftype
luawin_initcomsupport
luawin_inithandletype
luawin_inithbitmaptype
luawin_inithcursortype
luawin_inithdctype
luawin_inithdesktype
luawin_inithgdiobjtype
luawin_inithicontype
luawin_inithkeytype
luawin_inithmenutype
luawin_inithmoduletype
luawin_inithtreeitemtype
luawin_inithwinstatype
luawin_inithwndtype
luawin_initkbdstatetype
luawin_initmsgtype
luawin_initpaintstructtype
luawin_initpointtype
luawin_initrecttype
luawin_initsizetype
luawin_initvarianttype
luawin_ispointercached
luawin_newbstrarray
luawin_newbstrbox
luawin_newcachedpointer
luawin_newcachedpointerex
luawin_newcomobjectbox
luawin_newconnector
luawin_newgateway_IBindStatusCallback
luawin_newgateway_IClassFactory
luawin_newgateway_IDocHostUIHandler
luawin_newgateway_IDownloadManager
luawin_newgateway_IHttpNegotiate
luawin_newgateway_INewWindowManager
luawin_newgateway_IOleCommandTarget
luawin_newgateway_IServiceProvider
luawin_newgateway_IUnknown
luawin_newkbdstate
luawin_newmsg
luawin_newobjecttype
luawin_newobjecttypeex
luawin_newpaintstruct
luawin_newpoint
luawin_newrect
luawin_newsize
luawin_newvariantarray
luawin_openall
luawin_optastringarray
luawin_optatom
luawin_optcolorref
luawin_opthandle
luawin_opthbitmap
luawin_opthcursor
luawin_opthdc
luawin_opthdesk
luawin_opthgdiobj
luawin_opthicon
luawin_opthkey
luawin_opthmenu
luawin_opthmodule
luawin_opthtreeitem
luawin_opthwinsta
luawin_opthwnd
luawin_optlastring
luawin_optlwstring
luawin_optunsigned
luawin_optwstringarray
luawin_ownhdesk
luawin_ownhmenu
luawin_ownhmodule
luawin_ownhwinsta
luawin_pushastring
luawin_pushatom
luawin_pushboxedcomobject
luawin_pushbstr
luawin_pushcolorref
luawin_pushcomobject
luawin_pusherror
luawin_pusherror_code
luawin_pushexception
luawin_pushflags
luawin_pushguid
luawin_pushhandle
luawin_pushhbitmap
luawin_pushhcursor
luawin_pushhdc
luawin_pushhdesk
luawin_pushhgdiobj
luawin_pushhicon
luawin_pushhkey
luawin_pushhmenu
luawin_pushhmodule
luawin_pushhtreeitem
luawin_pushhwinsta
luawin_pushhwnd
luawin_pushlastring
luawin_pushlwstring
luawin_pushmsg
luawin_pushownedhandle
luawin_pushownedhbitmap
luawin_pushownedhdc
luawin_pushownedhdesk
luawin_pushownedhkey
luawin_pushownedhmenu
luawin_pushownedhmodule
luawin_pushownedhwinsta
luawin_pushpoint
luawin_pushrect
luawin_pushsize
luawin_pushvariant
luawin_pushvariantarray
luawin_pushwstring
luawin_registerIBindCtx
luawin_registerIBindStatusCallback
luawin_registerIBinding
luawin_registerIClassFactory
luawin_registerIDispatch
luawin_registerIDocHostUIHandler
luawin_registerIDownloadManager
luawin_registerIHttpNegotiate
luawin_registerIMoniker
luawin_registerINewWindowManager
luawin_registerIOleCommandTarget
luawin_registerISequentialStream
luawin_registerIServiceProvider
luawin_registerIStream
luawin_registercominterface
luawin_registerguids
luawin_registerintconst
luawin_setmetatable
luawin_setmetatableex
luawin_toastringarray
luawin_tobstr
luawin_tocolorref
luawin_tocomobject
luawin_tohandle
luawin_tohicon
luawin_tohmenu
luawin_tohmodule
luawin_tohwnd
luawin_tokbdstate
luawin_tolastring
luawin_tolwstring
luawin_tomsg
luawin_toobject
luawin_toobjectex
luawin_topaintstruct
luawin_topoint
luawin_tosize
luawin_towstringarray

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/procmgr.exe
.exe windows:4 windows x86 arch:x86

03f27eb5c1ffd238e6dea61faa9c4ead

Code Sign

11:82:19:cc:8e:14:5c:d7:af:ed:2f:d8:39:31:e1:2d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/11/2006, 00:00

Not After

24/11/2007, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5c:88:08:e2:a9:1d:72:cf:1c:d7:ae:c8:15:8c:4f:b9:ac:e5:29:2a
Signer

Actual PE Digest

5c:88:08:e2:a9:1d:72:cf:1c:d7:ae:c8:15:8c:4f:b9:ac:e5:29:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

FindWindowExW
IsWindow
GetWindowThreadProcessId
MessageBoxW
GetMessageW
TranslateMessage
DispatchMessageW
CreateWindowExW
SetWindowLongW
RegisterClassExW
PostMessageW
DestroyWindow
PostQuitMessage
GetWindowLongW
DefWindowProcW

msvcrt

_controlfp
_except_handler3
__set_app_type
_wgetenv
??2@YAPAXI@Z
memset
wcscmp
__p___wargv
__p___argc
free
fclose
_wfopen
realloc
malloc
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode

kernel32

GetStartupInfoW
GetModuleHandleW
WaitForSingleObject
CreateProcessW
RegisterWaitForSingleObject
OpenProcess
CloseHandle
UnregisterWaitEx
TerminateProcess

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/serotek.lua51.bit.dll
.dll windows:4 windows x86 arch:x86

c614291aa7f7b9d140995e0355a3cb5e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

luaL_openlib
lua_gettop
luaL_checknumber
lua_pushnumber

msvcrt

_ftol
free
_initterm
malloc
_adjust_fdiv

kernel32

DisableThreadLibraryCalls

Exports

Exports

luaopen_bit

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 518B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/serotek.lua51.lfs.dll
.dll windows:5 windows x86 arch:x86

cd97d871f87dd1ef422761b7acb7989e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

luaL_register
lua_pushlstring
lua_isstring
lua_tolstring
lua_type
lua_createtable
lua_rawset
lua_pushnumber
lua_gettop
luaL_optnumber
luaL_newmetatable
lua_settable
lua_newuserdata
lua_getfield
lua_setmetatable
lua_pushcclosure
lua_touserdata
luaL_argerror
luaL_optinteger
luaL_checkoption
lua_pushinteger
luaL_checkudata
luaL_error
lua_pushstring
luaL_checklstring
lua_pushnil
lua_pushfstring
lua_pushboolean

msvcrt

_umask
_wmkdir
_wfindnext
_wfindfirst
_wstati64
malloc
_wgetcwd
_wrmdir
_wutime
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
strcmp
strlen
sprintf
_findclose
_fileno
_setmode
fseek
ftell
_locking
free
_errno
strerror
_wchdir

kernel32

GetVersion
RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

Exports

Exports

luaopen_lfs

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/cjpeg.exe
.exe windows:5 windows x86 arch:x86

bf5ca92b83d9726165a851cc313997da

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9a:82:20:b2:01:ea:6d:01:c3:01:bf:45:4b:e8:e3:d0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

02/12/2009, 00:00

Not After

02/12/2010, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cc:99:b0:af:e4:d1:61:5b:95:48:c9:d0:01:60:63:e4:06:a4:01:f4
Signer

Actual PE Digest

cc:99:b0:af:e4:d1:61:5b:95:48:c9:d0:01:60:63:e4:06:a4:01:f4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libjpeg

jpeg_add_quant_table
jpeg_set_colorspace
jpeg_quality_scaling
jpeg_set_quality
jpeg_simple_progression
jpeg_std_error
jpeg_CreateCompress
jpeg_set_defaults
jpeg_default_colorspace
jpeg_stdio_dest
jpeg_start_compress
jpeg_write_scanlines
jpeg_finish_compress
jpeg_destroy_compress

msvcrt

ungetc
getc
sscanf
fread
isdigit
isspace
memcpy
tolower
isupper
__getmainargs
_cexit
_exit
_XcptFilter
_initterm
_amsg_exit
_iob
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
_fileno
fprintf
fopen
exit
fclose
__setusermatherr
_setmode

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/credhook.dll
.dll windows:5 windows x86 arch:x86

68d3a9bfb0acd783a1c0dbe5811a25fa

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17/05/2005, 00:00

Not After

16/05/2010, 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

08:78:33:7a:4b:71:9d:d2:1e:4a:15:f3:d0:fb:ba:39
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/11/2008, 00:00

Not After

25/11/2009, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ba:13:1c:70:34:72:60:96:34:3c:d8:84:3f:d7:b1:af:07:bc:57:52
Signer

Actual PE Digest

ba:13:1c:70:34:72:60:96:34:3c:d8:84:3f:d7:b1:af:07:bc:57:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\credhook\binrel32\credhook.pdb

Imports

ole32

CoCreateInstance

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
_except_handler3
_stricmp
memset

kernel32

GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
RtlUnwind
LoadLibraryW
GetModuleFileNameW
Sleep
SetLastError
GetCurrentProcessId
GetCurrentThreadId

ntdll

LdrLoadDll
NtSetSystemInformation
NtProtectVirtualMemory
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrGetDllHandle

Exports

Exports

InstallCredHook

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/doc/legal/expat.txt
$LOCALAPPDATA/System Access to Go/SAWebStart/doc/legal/lua.txt
$LOCALAPPDATA/System Access to Go/SAWebStart/doc/legal/luaexpat.txt
$LOCALAPPDATA/System Access to Go/SAWebStart/doc/legal/ogg.txt
$LOCALAPPDATA/System Access to Go/SAWebStart/doc/legal/vnc-viewer.txt
$LOCALAPPDATA/System Access to Go/SAWebStart/doc/legal/vorbis.txt
$LOCALAPPDATA/System Access to Go/SAWebStart/dummycf.dll
.dll windows:5 windows x86 arch:x86

a38c34ae9980a7bcdbc02e0c95b551fd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
free
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??3@YAXPAX@Z
memcmp

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetSystemTimeAsFileTime

Exports

Exports

DllGetClassObject

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/fpnserver.pem
$LOCALAPPDATA/System Access to Go/SAWebStart/inproc-351/SAXL32.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e3:88:76:ee:3e:53:27:a5:8e:07:b4:59:42:2b:b5:8f:09:c2:bc:4e
Signer

Actual PE Digest

e3:88:76:ee:3e:53:27:a5:8e:07:b4:59:42:2b:b5:8f:09:c2:bc:4e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 9KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/inproc-351/STSA32.dll
.dll windows:5 windows x86 arch:x86

d07c2d5b90077072e806e4b2fca06c08

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:8f:4e:88:ce:4c:4c:a5:b8:69:0c:e7:e8:ce:42:61:05:83:18:1c
Signer

Actual PE Digest

6a:8f:4e:88:ce:4c:4c:a5:b8:69:0c:e7:e8:ce:42:61:05:83:18:1c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\inproc\dll\binrel32\STSA32.pdb

Imports

kernel32

FreeConsole
CreateFileW
AttachConsole
GetConsoleScreenBufferInfo
CloseHandle
ReadConsoleOutputCharacterW
TlsGetValue
FindResourceW
FreeLibrary
LoadResource
InterlockedIncrement
InterlockedDecrement
GetCurrentProcess
GetModuleHandleW
GetTickCount
WriteFile
InitializeCriticalSection
TlsSetValue
OpenProcess
Thread32First
LoadLibraryW
Sleep
SizeofResource
LeaveCriticalSection
Thread32Next
GetMailslotInfo
ReadFile
GetModuleFileNameW
CreateMailslotW
GetLastError
GetCurrentDirectoryW
SetLastError
GetProcAddress
EnterCriticalSection
LockResource
CreateToolhelp32Snapshot
OpenEventW
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
GetCurrentProcessId
DebugBreak
TlsFree
IsBadReadPtr
IsDebuggerPresent
MulDiv
ProcessIdToSessionId
VerSetConditionMask
VerifyVersionInfoW
GetVersion
PulseEvent
WaitForSingleObject
SetEvent
SetThreadPriority
CreateEventW
CreateThread
Module32FirstW
Module32NextW
WideCharToMultiByte
MultiByteToWideChar
FormatMessageA
LocalFree
GetDateFormatW
GetLocaleInfoW
GetTimeFormatW
GetThreadLocale
GlobalLock
GlobalAlloc
GlobalUnlock
GetEnvironmentVariableW
GetTempFileNameW
CreateMutexW
FindFirstFileW
GetDriveTypeW
CreateProcessW
LoadLibraryExW
MoveFileExW
GetLogicalDriveStringsW
QueryPerformanceCounter
GetEnvironmentStringsW
GetComputerNameW
ConnectNamedPipe
CreateNamedPipeW
GetSystemDirectoryW
CopyFileW
GetSystemPowerStatus
GetExitCodeProcess
Beep
TerminateProcess
GetTempPathW
OpenMutexW
GetLongPathNameW
SetVolumeLabelW
RemoveDirectoryW
WaitForMultipleObjects
FreeEnvironmentStringsW
FindNextFileW
QueryPerformanceFrequency
GetShortPathNameW
ReleaseMutex
GetDiskFreeSpaceExW
DeleteFileW
GetVolumeInformationW
FindClose
GetModuleFileNameA
GetCurrentDirectoryA
LocalAlloc
InterlockedExchange
LoadLibraryA
RaiseException
HeapFree
WriteConsoleW
GetFileType
GetStdHandle
HeapAlloc
GetCommandLineA
HeapReAlloc
LockFile
UnlockFile
FileTimeToSystemTime
FileTimeToLocalFileTime
RtlUnwind
ExitProcess
CreateProcessA
DuplicateHandle
GetSystemTimeAsFileTime
GetFullPathNameW
CreateDirectoryW
SetEnvironmentVariableW
SetCurrentDirectoryW
MoveFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetStartupInfoA
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
GetModuleHandleA
HeapSize
LCMapStringA
LCMapStringW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
SetStdHandle
SetFilePointer
GetFileAttributesA
CreateFileA
CompareStringA
CompareStringW
InitializeCriticalSectionAndSpinCount
CreatePipe
GetTimeZoneInformation
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetDriveTypeA
GetFileAttributesW
VirtualQuery
WriteConsoleA
GetConsoleOutputCP
SetEndOfFile
GetProcessHeap
SetEnvironmentVariableA

ntdll

NtSetSystemInformation
NtProtectVirtualMemory
_stricmp
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrGetDllHandle
LdrLoadDll
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtClose
NtQueryInformationThread
NtWaitForSingleObject
NtResumeThread
NtSetInformationThread
RtlCreateUserThread
NtWriteVirtualMemory
NtReadVirtualMemory
swprintf
NtQueryInformationProcess

Exports

Exports

BringToFront
GetFBSAMainAPI
InstallHook
MainHelper
RemoveHook

Sections

.text
Size: 839KB - Virtual size: 839KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/inproc-351/STSA64.dll
.dll windows:5 windows x64 arch:x64

f872118e0825aab52f305a528f57d8e3

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ed:18:c9:9d:81:4d:80:7e:c2:37:59:0c:f7:3e:14:8f:d3:74:10:15
Signer

Actual PE Digest

ed:18:c9:9d:81:4d:80:7e:c2:37:59:0c:f7:3e:14:8f:d3:74:10:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\inproc\dll\binrel64\STSA64.pdb

Imports

kernel32

FreeConsole
CreateFileW
AttachConsole
GetConsoleScreenBufferInfo
CloseHandle
ReadConsoleOutputCharacterW
GetProcessIdOfThread
TlsGetValue
FindResourceW
FreeLibrary
LoadResource
GetCurrentProcess
GetModuleHandleW
GetTickCount
WriteFile
InitializeCriticalSection
TlsSetValue
OpenProcess
Thread32First
LoadLibraryW
Sleep
SizeofResource
LeaveCriticalSection
Thread32Next
GetMailslotInfo
ReadFile
GetModuleFileNameW
CreateMailslotW
GetLastError
GetCurrentDirectoryW
SetLastError
GetProcAddress
EnterCriticalSection
OpenThread
LockResource
CreateToolhelp32Snapshot
OpenEventW
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
GetCurrentProcessId
DebugBreak
TlsFree
IsBadReadPtr
IsDebuggerPresent
MulDiv
ProcessIdToSessionId
VerSetConditionMask
VerifyVersionInfoW
GetVersion
PulseEvent
WaitForSingleObject
SetEvent
SetThreadPriority
CreateEventW
CreateThread
Module32FirstW
Module32NextW
WideCharToMultiByte
MultiByteToWideChar
FormatMessageA
LocalFree
GetDateFormatW
GetLocaleInfoW
GetTimeFormatW
GetThreadLocale
GlobalLock
GlobalAlloc
GlobalUnlock
GetEnvironmentVariableW
GetTempFileNameW
CreateMutexW
FindFirstFileW
GetDriveTypeW
CreateProcessW
LoadLibraryExW
MoveFileExW
GetLogicalDriveStringsW
QueryPerformanceCounter
GetEnvironmentStringsW
GetComputerNameW
ConnectNamedPipe
CreateNamedPipeW
GetSystemDirectoryW
CopyFileW
GetSystemPowerStatus
GetExitCodeProcess
Beep
TerminateProcess
GetTempPathW
OpenMutexW
GetLongPathNameW
SetVolumeLabelW
RemoveDirectoryW
WaitForMultipleObjects
FreeEnvironmentStringsW
FindNextFileW
QueryPerformanceFrequency
GetShortPathNameW
ReleaseMutex
GetDiskFreeSpaceExW
DeleteFileW
GetVolumeInformationW
FindClose
GetModuleFileNameA
GetCurrentDirectoryA
LocalAlloc
LoadLibraryA
RaiseException
HeapFree
WriteConsoleW
GetFileType
GetStdHandle
HeapAlloc
FlsSetValue
GetCommandLineA
HeapReAlloc
LockFile
UnlockFile
FileTimeToSystemTime
FileTimeToLocalFileTime
RtlUnwindEx
ExitProcess
CreateProcessA
DuplicateHandle
GetSystemTimeAsFileTime
GetFullPathNameW
CreateDirectoryW
SetEnvironmentVariableW
SetCurrentDirectoryW
MoveFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
HeapCreate
HeapDestroy
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
SetHandleCount
GetStartupInfoA
FlushFileBuffers
RtlPcToFileHeader
FreeEnvironmentStringsA
GetEnvironmentStrings
HeapSize
LCMapStringA
LCMapStringW
GetDateFormatA
GetTimeFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
SetStdHandle
SetFilePointer
GetFileAttributesA
CreateFileA
CompareStringA
CompareStringW
InitializeCriticalSectionAndSpinCount
CreatePipe
GetTimeZoneInformation
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetDriveTypeA
GetFileAttributesW
WriteConsoleA
GetConsoleOutputCP
SetEndOfFile
GetProcessHeap
SetEnvironmentVariableA

ntdll

NtSetSystemInformation
NtProtectVirtualMemory
_stricmp
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrGetDllHandle
LdrLoadDll
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtClose
NtQueryInformationThread
NtWaitForSingleObject
NtResumeThread
NtSetInformationThread
RtlCreateUserThread
NtWriteVirtualMemory
NtReadVirtualMemory
RtlEncodeSystemPointer
NtQueueApcThread
swprintf
NtQueryInformationProcess

Exports

Exports

BringToFront
GetFBSAMainAPI
InstallHook
MainHelper
RemoveHook

Sections

.text
Size: 955KB - Virtual size: 955KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 262KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/inproc-351/STSAH32.dll
.dll windows:5 windows x86 arch:x86

a04112fe506f90a09102fe85b037e1d8

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b1:5a:90:6a:ac:34:1a:d9:c1:4d:90:bc:67:c5:6f:df:81:0d:58:b2
Signer

Actual PE Digest

b1:5a:90:6a:ac:34:1a:d9:c1:4d:90:bc:67:c5:6f:df:81:0d:58:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\inproc\ah6x\hookdll\binrel32\STSAH32.pdb

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
GetModuleHandleW
InitializeCriticalSection
LoadLibraryW
Sleep
LeaveCriticalSection
GetModuleFileNameW
FreeLibraryAndExitThread
EnterCriticalSection
DisableThreadLibraryCalls
OpenEventW
DeleteCriticalSection
CloseHandle
ResumeThread
GetProcAddress
GetLastError
SetLastError
FreeLibrary
LocalAlloc
InterlockedExchange
LoadLibraryA
RaiseException
WriteConsoleW
GetFileType
GetStdHandle
ExitThread
GetCurrentThreadId
CreateThread
ExitProcess
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapFree
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
VirtualQuery
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapAlloc
VirtualAlloc
HeapReAlloc
HeapSize
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
CreateFileA
GetModuleHandleA

ntdll

NtSetSystemInformation
NtProtectVirtualMemory
_stricmp
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrGetDllHandle
LdrLoadDll
swprintf
NtReadVirtualMemory
NtQueryInformationProcess
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtClose
NtWaitForSingleObject
NtResumeThread
NtSetInformationThread
RtlCreateUserThread
NtWriteVirtualMemory
NtQueryInformationThread

Exports

Exports

Attach

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/inproc-351/STSAH64.dll
.dll windows:5 windows x64 arch:x64

dd4ac38b09e25f606eeaab8fe281a781

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c8:ce:27:88:3d:42:8b:22:5d:90:6d:ca:f7:0a:9b:a7:3a:27:9f:7e
Signer

Actual PE Digest

c8:ce:27:88:3d:42:8b:22:5d:90:6d:ca:f7:0a:9b:a7:3a:27:9f:7e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\inproc\ah6x\hookdll\binrel64\STSAH64.pdb

Imports

kernel32

VerSetConditionMask
WaitForSingleObject
GetModuleHandleW
InitializeCriticalSection
LoadLibraryW
Sleep
LeaveCriticalSection
GetModuleFileNameW
VerifyVersionInfoW
FreeLibraryAndExitThread
EnterCriticalSection
DisableThreadLibraryCalls
OpenEventW
DeleteCriticalSection
CloseHandle
GetVersion
ResumeThread
GetProcAddress
GetLastError
SetLastError
FreeLibrary
LocalAlloc
LoadLibraryA
RaiseException
ExitThread
GetCurrentThreadId
CreateThread
ExitProcess
FlsSetValue
GetCommandLineA
WriteConsoleW
GetFileType
GetStdHandle
DebugBreak
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
HeapFree
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapAlloc
HeapReAlloc
HeapSize
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
CreateFileA

ntdll

NtQueryInformationThread
NtSetSystemInformation
NtProtectVirtualMemory
_stricmp
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrGetDllHandle
LdrLoadDll
swprintf
NtReadVirtualMemory
NtQueryInformationProcess
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtClose
NtWaitForSingleObject
NtResumeThread
NtSetInformationThread
RtlCreateUserThread
NtWriteVirtualMemory
RtlEncodeSystemPointer
NtQueueApcThread

Exports

Exports

Attach

Sections

.text
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/inproc-351/STSARes.dll
.dll windows:5 windows x86 arch:x86

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e6:7d:b9:11:d4:ff:8e:5f:bd:b8:78:5e:bf:b5:6c:03:ac:a1:fa:19
Signer

Actual PE Digest

e6:7d:b9:11:d4:ff:8e:5f:bd:b8:78:5e:bf:b5:6c:03:ac:a1:fa:19

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/inproc-351/STSAW32.dll
.dll windows:5 windows x86 arch:x86

e666a58ad5f5638601330583ead48e9f

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

78:bc:08:c7:a6:9d:a2:0b:9b:cb:17:ab:c2:7b:d4:9f:1b:19:c9:ec
Signer

Actual PE Digest

78:bc:08:c7:a6:9d:a2:0b:9b:cb:17:ab:c2:7b:d4:9f:1b:19:c9:ec

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\inproc\whdll\binrel32\STSAW32.pdb

Imports

user32

CallNextHookEx

msvcrt

_initterm
_amsg_exit
_adjust_fdiv
free
malloc
_XcptFilter
wcsrchr

kernel32

GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary

Exports

Exports

CallWndProc
GetMsgProc
KeyboardProc
MainDLLLoaded
MainDLLUnloaded
MouseProc
WinEventProc

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1014B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/inproc-351/STSAW64.dll
.dll windows:5 windows x64 arch:x64

1e03255ca039d79bc001d02a3a177888

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

76:aa:86:a1:5c:9a:61:fa:26:a6:76:45:1c:87:10:a5:60:42:58:2f
Signer

Actual PE Digest

76:aa:86:a1:5c:9a:61:fa:26:a6:76:45:1c:87:10:a5:60:42:58:2f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\inproc\whdll\binrel64\STSAW64.pdb

Imports

user32

CallNextHookEx

msvcrt

_XcptFilter
malloc
_initterm
free
_amsg_exit
__C_specific_handler
wcsrchr

kernel32

GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary

Exports

Exports

CallWndProc
GetMsgProc
KeyboardProc
MainDLLLoaded
MainDLLUnloaded
MouseProc
WinEventProc

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/keymenu.exe
.exe .js windows:5 windows x86 arch:x86 polyglot

59d4c6711efac6455c22f56a4ecb49ba

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

17:c0:20:a3:6e:6f:0b:b1:af:d8:ea:2d:3b:04:e7:5b:eb:6a:be:e3
Signer

Actual PE Digest

17:c0:20:a3:6e:6f:0b:b1:af:d8:ea:2d:3b:04:e7:5b:eb:6a:be:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\serotek\sa\keymenu\keymenu.pdb

Imports

luahost

luahost_close
luahost_setstateinitfunction
luahost_initstate
luahost_newstate
luahost_message
luahost_registercmodules
luahost_report
luahost_pcall
luahost_domainresource

luawin

luawin_checklwstring
luawin_pushwstring

lua51

lua_createtable
lua_pushboolean
lua_touserdata
lua_gc
lua_toboolean
lua_pushinteger
luaL_register
lua_newuserdata
lua_pushlstring
lua_settop
lua_getfield
luaL_openlibs
lua_pushcclosure
lua_setfield
lua_type
luaL_checklstring
lua_cpcall

user32

SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx

msvcrt

towupper
memset
__wgetmainargs
_cexit
iswctype
_XcptFilter
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
wcsrchr
swprintf
wcsncpy
_wgetenv
_wcsicmp
__argc
__wargv
malloc
strlen
_wputenv
_exit

kernel32

GetModuleHandleW
WideCharToMultiByte
GetModuleFileNameW
GetVolumeInformationW
RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/libexpat.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

XML_DefaultCurrent
XML_ErrorString
XML_ExpatVersion
XML_ExpatVersionInfo
XML_ExternalEntityParserCreate
XML_FreeContentModel
XML_GetBase
XML_GetBuffer
XML_GetCurrentByteCount
XML_GetCurrentByteIndex
XML_GetCurrentColumnNumber
XML_GetCurrentLineNumber
XML_GetErrorCode
XML_GetFeatureList
XML_GetIdAttributeIndex
XML_GetInputContext
XML_GetParsingStatus
XML_GetSpecifiedAttributeCount
XML_MemFree
XML_MemMalloc
XML_MemRealloc
XML_Parse
XML_ParseBuffer
XML_ParserCreate
XML_ParserCreateNS
XML_ParserCreate_MM
XML_ParserFree
XML_ParserReset
XML_ResumeParser
XML_SetAttlistDeclHandler
XML_SetBase
XML_SetCdataSectionHandler
XML_SetCharacterDataHandler
XML_SetCommentHandler
XML_SetDefaultHandler
XML_SetDefaultHandlerExpand
XML_SetDoctypeDeclHandler
XML_SetElementDeclHandler
XML_SetElementHandler
XML_SetEncoding
XML_SetEndCdataSectionHandler
XML_SetEndDoctypeDeclHandler
XML_SetEndElementHandler
XML_SetEndNamespaceDeclHandler
XML_SetEntityDeclHandler
XML_SetExternalEntityRefHandler
XML_SetExternalEntityRefHandlerArg
XML_SetNamespaceDeclHandler
XML_SetNotStandaloneHandler
XML_SetNotationDeclHandler
XML_SetParamEntityParsing
XML_SetProcessingInstructionHandler
XML_SetReturnNSTriplet
XML_SetSkippedEntityHandler
XML_SetStartCdataSectionHandler
XML_SetStartDoctypeDeclHandler
XML_SetStartElementHandler
XML_SetStartNamespaceDeclHandler
XML_SetUnknownEncodingHandler
XML_SetUnparsedEntityDeclHandler
XML_SetUserData
XML_SetXmlDeclHandler
XML_StopParser
XML_UseForeignDTD
XML_UseParserAsHandlerArg

Sections

.text
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/libjpeg.dll
.dll windows:5 windows x86 arch:x86

13c77744e5ddc86ccd58dd6c7c045b43

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

fflush
fread
exit
fprintf
_iob
sprintf
sscanf
getenv
malloc
free
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
ferror
fwrite
memcpy
memset

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetVersion
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetSystemTimeAsFileTime

Exports

Exports

jcopy_block_row
jcopy_sample_rows
jdiv_round_up
jinit_1pass_quantizer
jinit_2pass_quantizer
jinit_c_coef_controller
jinit_c_main_controller
jinit_c_master_control
jinit_c_prep_controller
jinit_color_converter
jinit_color_deconverter
jinit_compress_master
jinit_d_coef_controller
jinit_d_main_controller
jinit_d_post_controller
jinit_downsampler
jinit_forward_dct
jinit_huff_decoder
jinit_huff_encoder
jinit_input_controller
jinit_inverse_dct
jinit_marker_reader
jinit_marker_writer
jinit_master_decompress
jinit_memory_mgr
jinit_merged_upsampler
jinit_phuff_decoder
jinit_phuff_encoder
jinit_upsampler
jpeg_CreateCompress
jpeg_CreateDecompress
jpeg_abort
jpeg_abort_compress
jpeg_abort_decompress
jpeg_add_quant_table
jpeg_alloc_huff_table
jpeg_alloc_quant_table
jpeg_calc_output_dimensions
jpeg_consume_input
jpeg_copy_critical_parameters
jpeg_default_colorspace
jpeg_destroy
jpeg_destroy_compress
jpeg_destroy_decompress
jpeg_fdct_float
jpeg_fdct_ifast
jpeg_fdct_islow
jpeg_fill_bit_buffer
jpeg_finish_compress
jpeg_finish_decompress
jpeg_finish_output
jpeg_free_large
jpeg_free_small
jpeg_gen_optimal_table
jpeg_get_large
jpeg_get_small
jpeg_has_multiple_scans
jpeg_huff_decode
jpeg_idct_1x1
jpeg_idct_2x2
jpeg_idct_4x4
jpeg_idct_float
jpeg_idct_ifast
jpeg_idct_islow
jpeg_input_complete
jpeg_make_c_derived_tbl
jpeg_make_d_derived_tbl
jpeg_mem_available
jpeg_mem_init
jpeg_mem_term
jpeg_natural_order
jpeg_new_colormap
jpeg_open_backing_store
jpeg_quality_scaling
jpeg_read_coefficients
jpeg_read_header
jpeg_read_raw_data
jpeg_read_scanlines
jpeg_resync_to_restart
jpeg_save_markers
jpeg_set_colorspace
jpeg_set_defaults
jpeg_set_linear_quality
jpeg_set_marker_processor
jpeg_set_quality
jpeg_simple_progression
jpeg_start_compress
jpeg_start_decompress
jpeg_start_output
jpeg_std_error
jpeg_std_message_table
jpeg_stdio_dest
jpeg_stdio_src
jpeg_suppress_tables
jpeg_write_coefficients
jpeg_write_m_byte
jpeg_write_m_header
jpeg_write_marker
jpeg_write_raw_data
jpeg_write_scanlines
jpeg_write_tables
jround_up
jzero_far

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/locale/fr/LC_MESSAGES/sa.mo
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/chunk.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/copas.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/coxpcall.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/fbcommon/windows/http.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/fbcommon/windows/ui.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/decode.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/decode/array.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/decode/calls.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/decode/number.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/decode/object.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/decode/others.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/decode/strings.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/decode/util.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/encode.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/encode/array.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/encode/calls.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/encode/number.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/encode/object.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/encode/others.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/encode/output.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/encode/output_utility.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/encode/strings.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/json/util.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/ltn12.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/luacom.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/luawin.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/lxp/lom.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/md5.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/mime.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/socket/http.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/socket/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/socket/url.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/spm/chunkfile/reader.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/spm/fpk/reader.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/spm/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/spm/vercmp.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stbrl/content.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stbrl/drivers/alva.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stbrl/drivers/alvaserial.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stbrl/drivers/base.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stbrl/drivers/baum.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stbrl/drivers/handytech.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stbrl/drivers/rbdhid.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stbrl/drivers/seika.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stbrl/drivers/voyager.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stbrl/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stbrl/view.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/async/abstract.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/async/address.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/async/base.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/async/copish.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/async/defer.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/async/failure.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/async/main.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/async/protocol.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/async/reactor.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/async/reconnect.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/async/tcp.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/async/uiglue.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/audio.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/bayes.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/browser/cookie/ie.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/browser/cookie/init.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/browser/cookie/mozilla.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/browser/download.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/browser/im.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/browser/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/browser/mediaplayer.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/browser/prefs.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/browser/pwmgr/iauth.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/browser/pwmgr/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/browser/pwmgr/storage.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/browser/vchat.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/cfgfile.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/copulse.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/cotask.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/delay.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/delay/step.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/delay/win.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/dialogs.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/dialogs/win.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/dict.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/download/manager.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/download/web.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/fpn/client/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/fpn/client/web.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/fpn/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/fpn/server.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/fpn/serverui.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/gettext.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/hostinfo.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/hscheck.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/kbdcon.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/langdetect.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/licenses.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/localize.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/localize/unix.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/localize/win.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/log
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/log.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/logincfg.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/netsense.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/object.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/paths.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/paths/step.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/paths/win.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/platform.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/process.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/process/step.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/process/win.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/protocols/amp.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/protocols/banana.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/protocols/basic.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/protocols/portforward.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/protocols/sslwrap.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/rc/audioipc.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/rc/common.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/rc/constants.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/rc/rfb.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/rc/server.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/rc/serverctl.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/rc/serverproc.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/rc/wlhelper.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/registry.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/resources.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/samnstatus.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/serial.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/shutil.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/shutil/unix.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/shutil/win.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/sql.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/strutil.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/sync.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/teamtalk.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/config.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/dectalk.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/eloquence.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/espeak.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/espeakworker.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/init.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/ivona.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/ivonaworker.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/mac.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/rssolo.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/rssoloworker.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/sapi.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/sapi4.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/sapi4worker.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/textproc.lua
.ps1
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/tts/voicetext.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/usbstor.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/aiff.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/chunk.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/comutil.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/envtable.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/serialize.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/set.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/tempfile.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/tempfile/unix.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/tempfile/win.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/u3.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/ubase64.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/wave.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/util/ziputil.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/vfs/init.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/vfs/open.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/vfs/web.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/voip.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/apps/filemgr.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/apps/init.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/apps/ssca.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/cgiutil.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/client.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/client/step.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/client/win.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/framework.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/html.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/http.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/mimepost.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/pyserver.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/rawhttp.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/server.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/session.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/web/sht.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/windows/atl.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/windows/form.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/windows/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/windows/listbox.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/windows/msgloop.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/windows/statusbar.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/wllogin.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stcommon/workers.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/sths/config.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/sths/ctl.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/sths/init.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/sths/run/common.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/sths/run/init.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/sths/run/tray.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/sths/ui.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stmedialib/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stmedialib/paths.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stmedialib/playlist.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stpdsync/devutil.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stpdsync/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stpdsync/step.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stpdsync/tts.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stpdsync/win.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/auth.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/bgdownload.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/bootstrap.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/brl.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/config.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/csaw.lua
.vbs
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/ctl.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/excel.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/hooks.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/install/main.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/install/ui.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/install/worker.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/ipc.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/kbd.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/mag.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/main.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/progpack.lua
.vbs
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/raminstall.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/rcclient.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/rcserverui.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/scansolo.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/startupctl.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/ttsmsg.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/ui.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/uninstall/global.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/uninstall/user.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/version.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/webserver.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/wla/common.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/wla/ctl.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/wla/master.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stsa/wla/slave.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stscan/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stscan/old.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stu3/devutil.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stu3/install.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stu3/lpdb.lua
.vbs
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stu3/raminstall.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stu3/ramkeysetup.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stu3/u3pfile.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stu3/ui.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stupdate/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/stupdate/web.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/wave.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/wsapi/cgi.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/wsapi/common.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/wsapi/fastcgi.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/wsapi/request.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/wsapi/response.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/wsapi/ringer.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/wsapi/sapi.lua
.sh .js linux polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/wsapi/util.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/wsapi/xavante.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/xavante/cgiluahandler.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/xavante/encoding.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/xavante/filehandler.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/xavante/httpd.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/xavante/indexhandler.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/xavante/init.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/xavante/mime.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/xavante/patternhandler.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/xavante/redirecthandler.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/xavante/ruleshandler.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/xavante/urlhandler.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua/xavante/vhostshandler.lua
$LOCALAPPDATA/System Access to Go/SAWebStart/lua5.1.dll
.dll windows:5 windows x86 arch:x86

64760949872bc2b1d618f6758392d9d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Exports

Exports

luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Sections

.text
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 274B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/lua51.dll
.dll windows:5 windows x86 arch:x86

1c13004cdcc72ec49faf02bfed34ba8c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\lua\lua51\binrel32\lua51.pdb

Imports

msvcrt

exit
longjmp
_pclose
tmpfile
fscanf
clearerr
fwrite
ftell
fseek
setvbuf
fflush
iscntrl
localeconv
isalnum
isdigit
isalpha
fabs
sin
sinh
cos
cosh
tan
tanh
asin
acos
atan
atan2
ceil
fmod
modf
sqrt
log
log10
exp
frexp
ldexp
rand
srand
_HUGE
strrchr
strtod
sprintf
strncat
strcspn
strcat
strcpy
strncpy
tmpnam
clock
localtime
gmtime
time
mktime
difftime
setlocale
memcmp
tolower
_setjmp3
isupper
isxdigit
ispunct
islower
memchr
strpbrk
strcoll
_wfopen
_wfreopen
_wpopen
_strdup
malloc
_wgetenv
_wsystem
_wremove
_wrename
wcsftime
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
fgets
floor
pow
abs
strtoul
isspace
fputs
strstr
strcmp
fprintf
free
realloc
_iob
getc
ungetc
ferror
fclose
_errno
strerror
feof
fread
memcpy
strchr
toupper
strlen

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetVersion
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
SetLastError
GetModuleFileNameW
GetProcAddress
FreeLibrary
GetLastError
FormatMessageA
GetSystemTimeAsFileTime

Exports

Exports

luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmainthread
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlevel
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/luacom13.dll
.dll windows:5 windows x86 arch:x86

66e28189897447d57a7d2f0de56e66f5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\lua\luacom\binrel32\luacom13.pdb

Imports

lua51

lua_rawseti
lua_isuserdata
lua_rawgeti
lua_objlen
lua_call
lua_pushlstring
lua_getmainthread
lua_newthread
lua_close
lua_equal
lua_checkstack
lua_pushboolean
lua_pushlightuserdata
lua_tonumber
lua_tolstring
lua_type
lua_gettop
lua_settop
lua_pushnil
lua_pushcclosure
lua_settable
lua_pushstring
lua_createtable
lua_gettable
lua_pushvalue
lua_getmetatable
lua_newuserdata
lua_insert
lua_setmetatable
lua_error
luaL_openlib
luaL_checktype
luaL_loadbuffer
lua_pcall
lua_rawget
lua_remove
lua_touserdata
luaL_argerror
lua_pushnumber
luaL_unref
luaL_ref
luaL_optlstring
luaL_checklstring
luaL_checknumber
lua_getfield
lua_rawset
lua_toboolean

shlwapi

SHDeleteKeyA

oleaut32

VariantChangeType
SafeArrayUnaccessData
SysStringLen
VariantInit
VariantClear
SysAllocString
DispGetIDsOfNames
SafeArrayGetDim
SafeArrayCreate
SafeArrayGetElement
VariantCopy
SafeArrayPutElement
SystemTimeToVariantTime
VariantCopyInd
VariantTimeToSystemTime
SafeArrayAccessData
SafeArrayDestroy
SafeArrayCreateVector
LHashValOfNameSys
LoadRegTypeLi
SysFreeString
GetActiveObject
LoadTypeLibEx
UnRegisterTypeLi

ole32

CoTaskMemAlloc
CoLockObjectExternal
StringFromIID
CoRegisterClassObject
CoTaskMemFree
CoRevokeClassObject
CreateBindCtx
MkParseDisplayName
CoCreateInstance
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
StringFromCLSID

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegEnumKeyExA
RegCreateKeyExA

user32

GetMessageA
TranslateMessage
DispatchMessageA
WinHelpA

msvcrt

mbstowcs
??2@YAPAXI@Z
strcmp
strcat
_stricmp
strncmp
sscanf
strncpy
wprintf
memset
memcpy
_purecall
__RTDynamicCast
fclose
fflush
vfprintf
fprintf
_spawnlp
fopen
__CxxFrameHandler
wcslen
??1type_info@@UAE@XZ
_unlock
__dllonexit
_lock
_onexit
_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
wcstombs
_CxxThrowException
memcmp
sprintf
??3@YAXPAX@Z
strcpy
strlen
strncat
printf

kernel32

UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
SetUnhandledExceptionFilter
WideCharToMultiByte
GetLastError
FormatMessageA
LocalFree
GetCurrentDirectoryA
GetModuleFileNameA
GetVersion
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
MultiByteToWideChar

Exports

Exports

luacom_IDispatch2LuaCOM
luacom_close
luacom_detectAutomation
luacom_open
luacom_openlib

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/luahost.dll
.dll windows:5 windows x86 arch:x86

62957a95f7a81ebc8fbbad240b5e680a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\lua\luahost\bin\luahost.pdb

Imports

lua51

luaL_newstate
lua_close
luaL_error
lua_error
lua_pushlstring
luaL_loadbuffer
luaL_loadfile
lua_cpcall
lua_setfield
luaL_checkstack
lua_pushstring
lua_createtable
lua_rawseti
lua_gettop
lua_pushcclosure
lua_insert
lua_pcall
lua_remove
lua_gc
lua_getfield
lua_pushvalue
lua_pushinteger
lua_call
lua_type
lua_tolstring
lua_settop
lua_touserdata
luaL_openlibs

ole32

OleInitialize
OleUninitialize

user32

MessageBoxA

msvcrt

_initterm
_amsg_exit
_adjust_fdiv
malloc
_errno
memcpy
_beginthreadex
free
strlen
_XcptFilter

kernel32

LockResource
LoadResource
FindResourceA
GetModuleHandleA
CloseHandle
RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SizeofResource

Exports

Exports

luahost_callmain
luahost_close
luahost_dobuffer
luahost_dofile
luahost_domainbuffer
luahost_domainresource
luahost_doresource
luahost_dostring
luahost_getargs
luahost_getpreload
luahost_initstate
luahost_loadresource
luahost_message
luahost_newstate
luahost_openlibs
luahost_pcall
luahost_registercmodules
luahost_registerluachunkresources
luahost_registerluachunks
luahost_registerluamoduleresources
luahost_registerluamodules
luahost_report
luahost_setstateinitfunction
luahost_starttask

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/luawin.dll
.dll windows:5 windows x86 arch:x86

d1bf73413080a648902a66573c70ca02

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\lua\luawin\binrel32\luawin.pdb

Imports

luacom13

luacom_IDispatch2LuaCOM

lua51

lua_pushnumber
luaL_openlib
lua_newuserdata
lua_isstring
lua_tonumber
lua_settop
lua_gettop
lua_isnumber
luaL_error
lua_createtable
lua_setfield
luaL_checktype
luaL_checknumber
lua_pushfstring
lua_remove
lua_pushlstring
lua_rawgeti
lua_objlen
lua_pushnil
lua_type
luaL_checklstring
lua_call
lua_pushcclosure
luaL_argerror
lua_getallocf
luaL_optlstring
lua_tointeger
luaL_buffinit
luaL_addvalue
luaL_pushresult
luaL_addlstring
lua_getmetatable
luaL_ref
luaL_unref
lua_cpcall
lua_pcall
lua_tolstring
lua_error
lua_pushboolean
lua_setfenv
lua_newthread
lua_getmainthread
lua_getfenv
lua_isuserdata
luaL_optnumber
lua_rawseti
luaL_optinteger
lua_toboolean
lua_pushinteger
luaL_checkinteger
lua_touserdata
lua_getfield
lua_gettable
lua_pushlightuserdata
lua_insert
lua_concat
lua_setmetatable
lua_pushvalue
lua_pushstring
lua_rawget
lua_settable
lua_rawset

winhttp

WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpOpenRequest
WinHttpReadData
WinHttpReceiveResponse

winmm

PlaySoundW

sensapi

IsNetworkAlive

setupapi

CM_Get_Device_IDW
CM_Get_Sibling
CM_Get_Child
CM_Locate_DevNodeW
CM_Get_Parent

sfc

SfcIsFileProtected

wtsapi32

WTSQueryUserToken
WTSQuerySessionInformationW
WTSFreeMemory
WTSEnumerateSessionsW

shell32

SHGetDesktopFolder
ShellExecuteW
Shell_NotifyIconW
SHGetSpecialFolderPathW
ShellExecuteExW
SHBrowseForFolderW

shlwapi

PathCanonicalizeW
PathCombineW
StrCmpIW

wininet

InternetConnectW
InternetSetCookieW
InternetOpenW
DeleteUrlCacheEntryW
InternetSetCookieExW
InternetOpenUrlW
InternetReadFile
HttpOpenRequestW
HttpSendRequestW
InternetSetOptionW
InternetGetCookieW
HttpQueryInfoW
InternetAttemptConnect
InternetGetConnectedState
InternetCloseHandle

urlmon

RegisterBindStatusCallback
CreateURLMonikerEx
CreateAsyncBindCtx
UrlMkSetSessionOption
CreateURLMoniker
URLDownloadToFileW

oleacc

AccessibleObjectFromWindow
GetRoleTextW
CreateStdAccessibleObject
WindowFromAccessibleObject
AccessibleObjectFromPoint
AccessibleChildren
CreateStdAccessibleProxyW
AccessibleObjectFromEvent
GetStateTextW
ObjectFromLresult

oleaut32

SysStringLen
VariantInit
VariantCopyInd
VariantClear
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayDestroy
SafeArrayAccessData
LoadRegTypeLi
GetActiveObject
VariantChangeType
SysFreeString
SysAllocStringLen

ole32

CreateStreamOnHGlobal
CoUnmarshalInterface
CoMarshalInterface
CoRegisterClassObject
CoFreeUnusedLibrariesEx
IIDFromString
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CreateBindCtx
CLSIDFromProgID
StringFromGUID2
CoInitialize
CoCreateGuid

comdlg32

GetSaveFileNameW
GetOpenFileNameW

comctl32

InitCommonControlsEx

user32

TranslateMessage
GetCapture
GetDC
InsertMenuItemW
GetClassLongW
BeginPaint
SetFocus
GetClientRect
FindWindowW
WindowFromPoint
OpenDesktopW
OpenInputDesktop
WaitForInputIdle
GetProcessWindowStation
IsHungAppWindow
GetParent
GetFocus
SetForegroundWindow
GetKeyState
MsgWaitForMultipleObjects
KillTimer
PostMessageW
UnregisterClassW
SetKeyboardState
LoadImageW
GetThreadDesktop
PostQuitMessage
GetKeyboardState
GetWindowRect
ScreenToClient
RealChildWindowFromPoint
SetTimer
RealGetWindowClassW
MapVirtualKeyW
VkKeyScanW
CloseClipboard
keybd_event
SendNotifyMessageW
DestroyWindow
ClientToScreen
EndPaint
GetNextDlgTabItem
RegisterHotKey
DefWindowProcW
mouse_event
GetWindow
EnumThreadWindows
DispatchMessageW
RegisterWindowMessageW
CloseWindowStation
DestroyMenu
CloseDesktop
SendMessageW
GetWindowThreadProcessId
GetForegroundWindow
GetMenu
RegisterClassExW
GetGUIThreadInfo
GetKeyboardLayout
TrackPopupMenuEx
GetAsyncKeyState
SetCursorPos
GetWindowLongW
GetAncestor
GetWindowTextW
SystemParametersInfoW
SetClassLongW
PeekMessageW
GetClassNameW
EmptyClipboard
GetDlgItem
SetWindowLongW
RedrawWindow
GetSysColor
SetWindowPos
GetCursorPos
GetCaretPos
EnumChildWindows
GetLastInputInfo
ShowWindow
CreatePopupMenu
GetSysColorBrush
WindowFromDC
GetMenuItemCount
IsWindow
FindWindowExW
CreateWindowExW
GetCursor
PostThreadMessageW
OpenClipboard
MessageBoxW
GetSystemMetrics
IsWindowVisible
SetCaretPos
AllowSetForegroundWindow
GetUserObjectInformationW
UpdateWindow
SetClipboardData
UnregisterHotKey
GetDlgCtrlID
SetWindowTextW
ToUnicode
GetMessageW
GetDialogBaseUnits

gdi32

MaskBlt
LPtoDP
GetTextMetricsW
GetTextExtentPoint32W
StretchBlt
SetBrushOrgEx
CreateBitmap
GetDCOrgEx
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
StretchDIBits
SetStretchBltMode
GetStockObject
DeleteDC
BitBlt
DeleteObject

psapi

GetModuleBaseNameW
GetModuleFileNameExW
GetProcessImageFileNameW
EnumProcesses

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

advapi32

RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RevertToSelf
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
ImpersonateLoggedOnUser
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
GetUserNameW
RegCloseKey

kernel32

IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapAlloc
HeapFree
DeleteCriticalSection
GetStartupInfoA
SetHandleCount
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
GetStdHandle
GetFileType
WriteConsoleW
RaiseException
LoadLibraryA
InterlockedExchange
LocalAlloc
GetThreadLocale
GetTimeFormatW
GetLocaleInfoW
GetDateFormatW
GetVolumeInformationW
DeleteFileW
GetVersion
GetDiskFreeSpaceExW
LoadLibraryW
GlobalAlloc
FreeLibrary
FindClose
CloseHandle
InterlockedDecrement
InterlockedIncrement
LocalFree
ReleaseMutex
GetCurrentThreadId
GetShortPathNameW
QueryPerformanceFrequency
OpenEventW
FindNextFileW
FreeEnvironmentStringsW
TlsGetValue
FormatMessageA
GetCurrentProcessId
GlobalUnlock
GlobalLock
MultiByteToWideChar
WideCharToMultiByte
TlsAlloc
TlsSetValue
TlsFree
SetLastError
WaitForMultipleObjects
RemoveDirectoryW
CreateEventW
ProcessIdToSessionId
SetVolumeLabelW
GetLongPathNameW
GetCurrentDirectoryW
OpenMutexW
GetTempPathW
CreateMailslotW
CreateFileW
GetModuleFileNameW
ReadFile
GetMailslotInfo
TerminateProcess
Beep
GetExitCodeProcess
GetSystemPowerStatus
CopyFileW
Sleep
GetSystemDirectoryW
OpenProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
HeapCreate
HeapDestroy
VirtualFree
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
HeapReAlloc
VirtualAlloc
RtlUnwind
GetEnvironmentVariableW
GetTempFileNameW
CreateMutexW
FindFirstFileW
HeapSize
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CreateNamedPipeW
GetTickCount
GetModuleHandleW
ConnectNamedPipe
SetEvent
GetComputerNameW
WaitForSingleObject
GetEnvironmentStringsW
QueryPerformanceCounter
GetLogicalDriveStringsW
GetCurrentProcess
MoveFileExW
LoadLibraryExW
CreateProcessW
GetDriveTypeW
GetLocaleInfoA
GetModuleHandleA
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
CreateFileA
GetLastError
GetProcAddress

Exports

Exports

??0luawin_Gateway_IUnknown@@QAE@ABV0@@Z
??0luawin_Gateway_IUnknown@@QAE@PAUlua_State@@HPAUIUnknown@@@Z
??1luawin_Gateway_IUnknown@@MAE@XZ
??4luawin_Gateway_IUnknown@@QAEAAV0@ABV0@@Z
??_7luawin_Gateway_IUnknown@@6B@
?AddRef@luawin_Gateway_IUnknown@@UAGKXZ
?QueryInterface@luawin_Gateway_IUnknown@@UAGJABU_GUID@@PAPAX@Z
?Release@luawin_Gateway_IUnknown@@UAGKXZ
luaopen_atl
luaopen_cfgmgr
luaopen_combridge
luaopen_commctrl
luaopen_commdlg
luaopen_dbt
luaopen_devenum
luaopen_docobj
luaopen_downloadmgr
luaopen_dwmapi
luaopen_mmsystem
luaopen_msctf
luaopen_mshtml
luaopen_objbase
luaopen_ole
luaopen_ole2
luaopen_oleacc
luaopen_oleauto
luaopen_olectl
luaopen_psapi
luaopen_sensapi
luaopen_servprov
luaopen_sfc
luaopen_shdocvw
luaopen_shellapi
luaopen_shlobj
luaopen_shlwapi
luaopen_textserv
luaopen_textstor
luaopen_tom
luaopen_uiautomationclient
luaopen_uiautomationcore
luaopen_urlhist
luaopen_urlmon
luaopen_winbase
luaopen_windef
luaopen_winerror
luaopen_wingdi
luaopen_winhttp
luaopen_wininet
luaopen_winnls
luaopen_winnt
luaopen_winreg
luaopen_winuser
luaopen_winver
luaopen_wtsapi
luaopen_wtypes
luawin_checkIBindCtx
luawin_checkIBindStatusCallback
luawin_checkIClassFactory
luawin_checkIDispatch
luawin_checkIDocHostUIHandler
luawin_checkIDownloadManager
luawin_checkIHttpNegotiate
luawin_checkIMoniker
luawin_checkINewWindowManager
luawin_checkIOleCommandTarget
luawin_checkISequentialStream
luawin_checkIServiceProvider
luawin_checkIStream
luawin_checkaresourceid
luawin_checkastringarray
luawin_checkastringoratom
luawin_checkatom
luawin_checkbstr
luawin_checkcolorref
luawin_checkcomobject
luawin_checkguid
luawin_checkhandle
luawin_checkhandlelist
luawin_checkhbitmap
luawin_checkhbrush
luawin_checkhcursor
luawin_checkhdc
luawin_checkhdesk
luawin_checkhfindfile
luawin_checkhgdiobj
luawin_checkhicon
luawin_checkhkey
luawin_checkhmenu
luawin_checkhmodule
luawin_checkhr
luawin_checkhtreeitem
luawin_checkhuianode
luawin_checkhuiapatternobject
luawin_checkhuiatextrange
luawin_checkhwinsta
luawin_checkhwnd
luawin_checkiid
luawin_checkkbdstate
luawin_checklastring
luawin_checklwstring
luawin_checkmsg
luawin_checkobject
luawin_checkobjectex
luawin_checkpaintstruct
luawin_checkpoint
luawin_checksize
luawin_checkunsigned
luawin_checkvariant
luawin_checkwresourceid
luawin_checkwstringarray
luawin_checkwstringoratom
luawin_closehandle
luawin_closehfindfile
luawin_disownhdesk
luawin_disownhmenu
luawin_disownhmodule
luawin_disownhwinsta
luawin_error
luawin_error_code
luawin_freeboxedbstr
luawin_gatewaymethod
luawin_gatewaymethodcall
luawin_gatewaymethodimplsetup
luawin_initatomtype
luawin_initcachetable
luawin_initcolorreftype
luawin_initcomsupport
luawin_inithandletype
luawin_inithbitmaptype
luawin_inithbrushtype
luawin_inithcursortype
luawin_inithdctype
luawin_inithdesktype
luawin_inithfindfiletype
luawin_inithgdiobjtype
luawin_inithicontype
luawin_inithkeytype
luawin_inithmenutype
luawin_inithmoduletype
luawin_inithtreeitemtype
luawin_inithuianodetype
luawin_inithuiapatternobjecttype
luawin_inithuiatextrangetype
luawin_inithwinstatype
luawin_inithwndtype
luawin_initkbdstatetype
luawin_initmsgtype
luawin_initpaintstructtype
luawin_initpointtype
luawin_initsizetype
luawin_initvarianttype
luawin_ispointercached
luawin_newbstrarray
luawin_newbstrbox
luawin_newcachedpointer
luawin_newcachedpointerex
luawin_newcomobjectbox
luawin_newconnector
luawin_newgateway_IBindStatusCallback
luawin_newgateway_IClassFactory
luawin_newgateway_IDocHostUIHandler
luawin_newgateway_IDownloadManager
luawin_newgateway_IHttpNegotiate
luawin_newgateway_INewWindowManager
luawin_newgateway_IOleCommandTarget
luawin_newgateway_IServiceProvider
luawin_newgateway_IUnknown
luawin_newkbdstate
luawin_newmsg
luawin_newobjecttype
luawin_newobjecttypeex
luawin_newpaintstruct
luawin_newpoint
luawin_newsize
luawin_newvariantarray
luawin_openall
luawin_optastringarray
luawin_optatom
luawin_optcolorref
luawin_opthandle
luawin_opthbitmap
luawin_opthbrush
luawin_opthcursor
luawin_opthdc
luawin_opthdesk
luawin_opthfindfile
luawin_opthgdiobj
luawin_opthicon
luawin_opthkey
luawin_opthmenu
luawin_opthmodule
luawin_opthtreeitem
luawin_opthuianode
luawin_opthuiapatternobject
luawin_opthuiatextrange
luawin_opthwinsta
luawin_opthwnd
luawin_optlastring
luawin_optlwstring
luawin_optunsigned
luawin_optwstringarray
luawin_ownhdesk
luawin_ownhmenu
luawin_ownhmodule
luawin_ownhwinsta
luawin_pushastring
luawin_pushatom
luawin_pushbindinfo
luawin_pushboxedcomobject
luawin_pushbstr
luawin_pushcolorref
luawin_pushcomobject
luawin_pusherror
luawin_pusherror_code
luawin_pushexception
luawin_pushflags
luawin_pushguid
luawin_pushhandle
luawin_pushhbitmap
luawin_pushhbrush
luawin_pushhcursor
luawin_pushhdc
luawin_pushhdesk
luawin_pushhfindfile
luawin_pushhgdiobj
luawin_pushhicon
luawin_pushhkey
luawin_pushhmenu
luawin_pushhmodule
luawin_pushhtreeitem
luawin_pushhuianode
luawin_pushhuiapatternobject
luawin_pushhuiatextrange
luawin_pushhwinsta
luawin_pushhwnd
luawin_pushlastring
luawin_pushlwstring
luawin_pushmsg
luawin_pushownedhandle
luawin_pushownedhbitmap
luawin_pushownedhbrush
luawin_pushownedhdc
luawin_pushownedhdesk
luawin_pushownedhfindfile
luawin_pushownedhkey
luawin_pushownedhmenu
luawin_pushownedhmodule
luawin_pushownedhuianode
luawin_pushownedhuiapatternobject
luawin_pushownedhuiatextrange
luawin_pushownedhwinsta
luawin_pushpoint
luawin_pushrect
luawin_pushsize
luawin_pushvariant
luawin_pushvariantarray
luawin_pushwstring
luawin_registerIBindCtx
luawin_registerIBindStatusCallback
luawin_registerIBinding
luawin_registerIClassFactory
luawin_registerIDispatch
luawin_registerIDocHostUIHandler
luawin_registerIDownloadManager
luawin_registerIHttpNegotiate
luawin_registerIMoniker
luawin_registerINewWindowManager
luawin_registerIOleCommandTarget
luawin_registerISequentialStream
luawin_registerIServiceProvider
luawin_registerIStream
luawin_registercominterface
luawin_registerguids
luawin_registerintconst
luawin_setmetatable
luawin_setmetatableex
luawin_toastringarray
luawin_tobstr
luawin_tocolorref
luawin_tocomobject
luawin_tohandle
luawin_tohbrush
luawin_tohfindfile
luawin_tohicon
luawin_tohmenu
luawin_tohmodule
luawin_tohwnd
luawin_tokbdstate
luawin_tolastring
luawin_tolwstring
luawin_tomsg
luawin_toobject
luawin_toobjectex
luawin_topaintstruct
luawin_topoint
luawin_tosize
luawin_towstringarray

Sections

.text
Size: 304KB - Virtual size: 303KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/mmhook.dll
.dll windows:5 windows x86 arch:x86

9935c090219f027722fcd7b41e52ddf6

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

95:fe:af:b7:3d:81:66:af:89:bf:ff:67:6d:3c:a7:25:e6:e7:48:be
Signer

Actual PE Digest

95:fe:af:b7:3d:81:66:af:89:bf:ff:67:6d:3c:a7:25:e6:e7:48:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\mmhook\mmhook.pdb

Imports

winmm

waveOutReset

ole32

CoTaskMemFree
CoCreateInstance

user32

PostThreadMessageW
PostMessageW

msvcrt

_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
memset
_except_handler3
_stricmp
malloc
free

kernel32

GetCurrentThreadId
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
RtlUnwind
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSection

ntdll

LdrFindEntryForAddress
LdrLoadDll
LdrGetDllHandle
NtSetSystemInformation
NtProtectVirtualMemory
LdrGetProcedureAddress

Exports

Exports

InstallMMHook

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ahexec
Size: - Virtual size: 160B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/mpaudec.dll
.dll windows:5 windows x86 arch:x86

d2c73027332f7b8e6d53447396f5df26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_XcptFilter
malloc
_initterm
_amsg_exit
_adjust_fdiv
memmove
memcpy
memset
calloc
tan
pow
sqrt
sin
free
realloc

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetVersion
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetSystemTimeAsFileTime

Exports

Exports

mpaudec_clear
mpaudec_decode_frame
mpaudec_init

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/mpaudec.pyd
.dll windows:5 windows x86 arch:x86

07f2f927ea7876b4166202805e6865a8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mpaudec

mpaudec_init
mpaudec_decode_frame
mpaudec_clear

python26

PyExc_NotImplementedError
PyObject_SetAttr
PyObject_CallObject
PyDict_New
PyType_Ready
PyObject_SetAttrString
PyImport_AddModule
Py_InitModule4
PyObject_AsReadBuffer
PyExc_ValueError
PyObject_AsWriteBuffer
PyLong_FromUnsignedLong
PyObject_Cmp
PyInt_AsLong
PyInt_FromLong
_PyArg_ParseTupleAndKeywords_SizeT
PyModule_GetDict
PyTuple_New
PyCode_New
PyThreadState_Get
PyFrame_New
PyTraceBack_Here
PyString_FromString
PyDict_SetItemString
PyClass_New
PyString_FromStringAndSize
PyString_InternInPlace
_Py_NoneStruct
PyTraceBack_Type
PyExc_TypeError
PyExc_BaseException
PyType_IsSubtype
PyErr_SetString
PyObject_GetAttr
PyExc_NameError
PyErr_SetObject
PyErr_Fetch
PyErr_Occurred
PyErr_WriteUnraisable
PyErr_Restore
PyExc_Exception

msvcr90

_malloc_crt
free
_encoded_null
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encode_pointer

kernel32

Sleep
InterlockedCompareExchange
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedExchange

Exports

Exports

initmpaudec

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 978B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/mpaufile.lua
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/ogg.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ogg_packet_clear
ogg_page_bos
ogg_page_checksum_set
ogg_page_continued
ogg_page_eos
ogg_page_granulepos
ogg_page_packets
ogg_page_pageno
ogg_page_serialno
ogg_page_version
ogg_stream_clear
ogg_stream_destroy
ogg_stream_eos
ogg_stream_flush
ogg_stream_init
ogg_stream_packetin
ogg_stream_packetout
ogg_stream_packetpeek
ogg_stream_pagein
ogg_stream_pageout
ogg_stream_reset
ogg_stream_reset_serialno
ogg_sync_buffer
ogg_sync_clear
ogg_sync_destroy
ogg_sync_init
ogg_sync_pageout
ogg_sync_pageseek
ogg_sync_reset
ogg_sync_wrote
oggpackB_adv
oggpackB_adv1
oggpackB_bits
oggpackB_bytes
oggpackB_get_buffer
oggpackB_look
oggpackB_look1
oggpackB_read
oggpackB_read1
oggpackB_readinit
oggpackB_reset
oggpackB_write
oggpackB_writealign
oggpackB_writeclear
oggpackB_writecopy
oggpackB_writeinit
oggpackB_writetrunc
oggpack_adv
oggpack_adv1
oggpack_bits
oggpack_bytes
oggpack_get_buffer
oggpack_look
oggpack_look1
oggpack_read
oggpack_read1
oggpack_readinit
oggpack_reset
oggpack_write
oggpack_writealign
oggpack_writeclear
oggpack_writecopy
oggpack_writeinit
oggpack_writetrunc

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/pcre.dll
.dll windows:4 windows x86 arch:x86

2860bf0b1c8611ee88d3e771a5bf1709

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

memset
memcpy
memcmp
memmove
strcmp
free
malloc
strchr
strncmp
_pctype
__mb_cur_max
_isctype
tolower
_initterm
_adjust_fdiv
toupper
strlen

kernel32

DisableThreadLibraryCalls

Exports

Exports

pcre_callout
pcre_compile
pcre_compile2
pcre_config
pcre_copy_named_substring
pcre_copy_substring
pcre_dfa_exec
pcre_exec
pcre_free
pcre_free_substring
pcre_free_substring_list
pcre_fullinfo
pcre_get_named_substring
pcre_get_stringnumber
pcre_get_stringtable_entries
pcre_get_substring
pcre_get_substring_list
pcre_info
pcre_maketables
pcre_malloc
pcre_refcount
pcre_stack_free
pcre_stack_malloc
pcre_study
pcre_version

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/python/lib/site-packages/fbcommon.pth
$LOCALAPPDATA/System Access to Go/SAWebStart/python/lib/site-packages/fbcommon.zip
.zip
fbcommon/__init__.pyo
fbcommon/hscheck.pyo
fbcommon/logincfg.pyo
fbcommon/passkeydata.pyo
fbcommon/sactl.pyo
fbcommon/util/__init__.pyo
fbcommon/util/paths.pyo
fbcommon/util/threads.pyo
fbcommon/util/ubase64.pyo
fbcommon/util/ziputil.pyo
fbcommon/web/__init__.pyo
fbcommon/web/client/__init__.pyo
fbcommon/web/client/curl.pyo
fbcommon/web/proxy.pyo
fbcommon/web/sht.pyo
fbcommon/web/twutil.pyo
fbcommon/win32.pyo
fbcommon/win32guireactor.pyo
$LOCALAPPDATA/System Access to Go/SAWebStart/python/lib/site-packages/fbsa.pth
$LOCALAPPDATA/System Access to Go/SAWebStart/python/lib/site-packages/fbsa.zip
.zip
fbsa/__init__.pyo
fbsa/wla/__init__.pyo
fbsa/wla/ctl.pyo
fbsa/wla/master.pyo
$LOCALAPPDATA/System Access to Go/SAWebStart/python/lib/site-packages/mpaudec.pyo
$LOCALAPPDATA/System Access to Go/SAWebStart/python/lib/site-packages/mpaufile.pyo
$LOCALAPPDATA/System Access to Go/SAWebStart/python/lib/site-packages/mpauhead.pyo
$LOCALAPPDATA/System Access to Go/SAWebStart/reghook.dll
.dll windows:5 windows x86 arch:x86

f743b5f8890676c52c1677a7332ddb0c

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b1:1e:55:6b:ac:54:fe:b4:21:02:b9:84:42:49:f1:38:26:1e:49:3c
Signer

Actual PE Digest

b1:1e:55:6b:ac:54:fe:b4:21:02:b9:84:42:49:f1:38:26:1e:49:3c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\reghook\reghook.pdb

Imports

oleaut32

LoadTypeLi

msvcrt

wcsrchr
_iob
getenv
_stricmp
_except_handler3
memset
_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
fflush
swprintf
strstr
_wgetenv
_wcsnicmp
sprintf
_wcsicmp

kernel32

GetModuleFileNameW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
RtlUnwind
GetModuleFileNameA
LoadLibraryA
GetCurrentProcessId
Sleep

ntdll

NtProtectVirtualMemory
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrGetDllHandle
LdrLoadDll
NtSetSystemInformation

Exports

Exports

InstallRegHook

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ahexec
Size: - Virtual size: 800B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/res/fpnserver.crt
$LOCALAPPDATA/System Access to Go/SAWebStart/res/fpnserver.key
$LOCALAPPDATA/System Access to Go/SAWebStart/res/locale/fr/LC_MESSAGES/sa.mo
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/alert.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/balloon.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/click.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/clickable.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/common/im_typing.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/common/pw_entry.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/common/working.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/mclick.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/page_change.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/snap.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/sync_done.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/tt.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/vm_close.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/media/vm_open.ogg
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/about.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/choose.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/cred-prompt.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/download-or-stream.html
.html
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/jquery.min.js
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/links.js
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/localize.js
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/lua.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/prefs-brl.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/prefs-general.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/prefs-mag.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/prefs-startup.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/prefs-tts.html
.html
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/prefs-tts.js
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/prefs.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/prefs.js
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/prompt-password.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/prompt.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/rc-choose-machine.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/rc-options.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/rc-sharing.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/rm-player.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/save-open-scan-pdf.html
.html
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/save-or-open-document.html
.html
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/save-password.html
.html
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/saws-activate-full-tip.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/saws-login.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/scansolo-demo.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/scansolo-login.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/spell.html
.html
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/unsupported-site.html
.html
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/vchat.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/vchat.js
.js
$LOCALAPPDATA/System Access to Go/SAWebStart/res/ui/wm-player.html
.html .js polyglot
$LOCALAPPDATA/System Access to Go/SAWebStart/sendlogs.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

eb:76:dd:f8:3a:eb:d4:16:e5:a6:3f:61:b1:fa:09:39:70:83:d2:d8
Signer

Actual PE Digest

eb:76:dd:f8:3a:eb:d4:16:e5:a6:3f:61:b1:fa:09:39:70:83:d2:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 10KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.atlhostex.dll
.dll windows:5 windows x86 arch:x86

d8025dd37a3f8d358f17e8f3bfbaecc2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

luawin

luawin_initcomsupport
luawin_checkcomobject
luawin_checkiid
luawin_newcomobjectbox
luawin_checkhr
luawin_pushboxedcomobject

lua51

lua_settop
lua_type
luaL_register

atlhostex

AtlAxCreateHost

msvcrt

free
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
malloc

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind

Exports

Exports

luaopen_atlhostex

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.base64.dll
.dll windows:4 windows x86 arch:x86

26b213d361a2284ba3dc5d0c854c2f39

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

luaL_openlib
lua_pushlstring
lua_settable
luaL_addlstring
luaL_checklstring
luaL_buffinit
luaL_pushresult

msvcrt

_adjust_fdiv
malloc
_initterm
strchr
free

kernel32

DisableThreadLibraryCalls

Exports

Exports

luaopen_base64

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.bit.dll
.dll windows:4 windows x86 arch:x86

c614291aa7f7b9d140995e0355a3cb5e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

luaL_openlib
lua_gettop
luaL_checknumber
lua_pushnumber

msvcrt

_ftol
free
_initterm
malloc
_adjust_fdiv

kernel32

DisableThreadLibraryCalls

Exports

Exports

luaopen_bit

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 518B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.bz2.dll
.dll windows:4 windows x86 arch:x86

395e74b8e6b63a5248c3b54804bf46f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

luaL_checklstring
lua_objlen
luaL_buffinit
luaL_prepbuffer
lua_pushfstring
luaL_pushresult
lua_pushnil
lua_newuserdata
lua_getfield
lua_setmetatable
lua_error
luaL_checkudata
luaL_argerror
luaL_newmetatable
lua_pushlstring
lua_pushvalue
lua_rawset
luaL_openlib
lua_settop

msvcrt

malloc
_adjust_fdiv
_initterm
exit
_iob
fprintf
free

kernel32

DisableThreadLibraryCalls

Exports

Exports

luaopen_bz2

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 854B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 674B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.c-stcommon.hostinfo.dll
.dll windows:5 windows x86 arch:x86

33a3b154b4751477063cb206de3c1309

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\hostinfo\binrel32\serotek.lua51.c-stcommon.hostinfo.pdb

Imports

luawin

luawin_pushwstring

lua51

luaL_register
lua_settop
lua_toboolean
lua_createtable
lua_setfield
lua_pushinteger
lua_pushboolean

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
memset
wcsrchr
wcsncpy
_wgetenv
wcscpy
iswctype
towupper
wcscat
_wcsicmp
swprintf

kernel32

GetModuleFileNameW
RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetVolumeInformationW

Exports

Exports

luaopen_stcommon_hostinfo

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1010B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.c-stcommon.process.dll
.dll windows:5 windows x86 arch:x86

8b9ae9712d8d8dbf05f0a673c032a4cb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

luawin

luawin_pushwstring
luawin_checklwstring

lua51

luaL_register
lua_createtable
lua_pushnumber
lua_rawseti
luaL_checknumber
lua_settop
lua_pushboolean
lua_setfield

user32

GetThreadDesktop
GetUserObjectInformationW

msvcrt

_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
free
malloc
memset
wcsrchr
_wcsicmp

kernel32

Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
Thread32Next
Thread32First
Process32NextW
Process32FirstW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
CloseHandle

Exports

Exports

luaopen_stcommon_process

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.host.dll
.dll windows:5 windows x86 arch:x86

94768805fea3a95ec3be0a6c30a05f3f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\lua\luahost\bin\host.pdb

Imports

luahost

luahost_starttask

lua51

lua_settop
luaL_checklstring
luaL_error
lua_pushinteger
luaL_register

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
_errno
strerror

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter

Exports

Exports

luaopen_host

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 954B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.lfs.dll
.dll windows:5 windows x86 arch:x86

3111be7932eba9c65cddc52290f5024d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\lua\luafilesystem-1.4.1\bin\serotek.lua51.lfs.pdb

Imports

lua51

lua_settable
luaL_newmetatable
luaL_optnumber
lua_gettop
lua_pushnumber
lua_rawset
lua_newuserdata
lua_type
lua_tolstring
lua_isstring
lua_pushlstring
luaL_register
lua_getfield
lua_setmetatable
lua_pushcclosure
lua_touserdata
luaL_argerror
luaL_optinteger
luaL_checkoption
lua_pushinteger
luaL_checkudata
luaL_error
lua_pushstring
luaL_checklstring
lua_pushnil
lua_pushfstring
lua_createtable
lua_pushboolean

msvcrt

_umask
_wmkdir
_wfindnext
_wfindfirst
_wstati64
malloc
_wgetcwd
_wrmdir
_wutime
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
strcmp
strlen
sprintf
_findclose
_fileno
_setmode
fseek
ftell
_locking
free
_errno
strerror
_wchdir

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersion
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

Exports

Exports

luaopen_lfs

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.lpeg.dll
.dll windows:5 windows x86 arch:x86

b23b9e0c955a4d561d40596322dbd0a0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

luaL_checkstack
lua_isstring
lua_tonumber
lua_next
lua_pushnil
lua_pushinteger
lua_toboolean
luaL_checkudata
lua_pushlstring
luaL_checkinteger
luaL_checktype
lua_call
lua_insert
luaL_addlstring
luaL_pushresult
luaL_addvalue
luaL_buffinit
lua_pushstring
luaL_register
luaL_newmetatable
lua_remove
lua_pushlightuserdata
luaL_optinteger
lua_settable
lua_getmetatable
lua_rawequal
lua_gettop
luaL_checklstring
luaL_argerror
lua_getfield
lua_setmetatable
lua_pushvalue
lua_touserdata
lua_objlen
lua_equal
lua_setfenv
lua_createtable
lua_rawseti
lua_newuserdata
lua_replace
lua_getfenv
lua_rawgeti
lua_gettable
lua_typename
lua_tointeger
luaL_error
lua_settop
lua_tolstring
lua_pushfstring
lua_type
luaL_prepbuffer

msvcrt

malloc
free
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
strlen
strspn
_assert
memcpy
printf

kernel32

GetVersion
RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

Exports

Exports

luaopen_lpeg

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.lxp.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

luaopen_lxp

Sections

UPX0
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.md5.core.dll
.dll windows:5 windows x86 arch:x86

69cdeef3c0c03d4c7dbd2422b67fd904

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

luaL_openlib
lua_settable
lua_concat
luaL_addlstring
luaL_error
lua_type
luaL_argerror
luaL_buffinit
luaL_prepbuffer
luaL_pushresult
luaL_checklstring
lua_pushlstring

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
time
memcpy
memset

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcessId

Exports

Exports

luaopen_md5_core

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.mime.core.dll
.dll windows:4 windows x86 arch:x86

c7b1be607e924005920a9ca3896f5627

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

luaL_optlstring
luaL_checknumber
lua_pushlstring
luaL_optnumber
luaL_addlstring
luaL_checkinteger
lua_pushnil
luaL_buffinit
luaL_addstring
luaL_prepbuffer
luaL_pushresult
lua_pushnumber
lua_pushstring
luaL_openlib
lua_tolstring
lua_rawset

msvcrt

_adjust_fdiv
malloc
_initterm
free
_ftol

kernel32

DisableThreadLibraryCalls

Exports

Exports

luaopen_mime_core

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 861B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.mpaudec.dll
.dll windows:5 windows x86 arch:x86

277dc7a35ca41da2408544bf4b738add

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mpaudec

mpaudec_decode_frame
mpaudec_init
mpaudec_clear

lua51

luaL_register
lua_setfield
lua_getfield
luaL_newmetatable
lua_setmetatable
luaL_checklstring
lua_newuserdata
luaL_error
lua_pushnil
lua_pushlstring
lua_toboolean
lua_pushinteger
lua_settop
luaL_argerror
luaL_checkudata
lua_pushvalue

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

Exports

Exports

luaopen_mpaudec

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.pack.dll
.dll windows:4 windows x86 arch:x86

ba388d42c4d975e5d21c7d27fa9390dd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

luaL_openlib
luaL_buffinit
luaL_checknumber
luaL_addlstring
luaL_pushresult
luaL_argerror
luaL_checklstring
luaL_optnumber
lua_objlen
lua_pushnil
lua_pushlstring
lua_pushnumber
lua_replace

msvcrt

_adjust_fdiv
malloc
_initterm
free
_ftol
__mb_cur_max
_isctype
_pctype
memcpy
strlen

kernel32

DisableThreadLibraryCalls

Exports

Exports

luaopen_pack

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 166B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.polarssl.dll
.dll windows:5 windows x86 arch:x86

db1a8187e0fd4e766e070f2fb66265cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\lua\polarssl\binrel32\serotek.lua51.polarssl.pdb

Imports

lua51

lua_setmetatable
luaL_openlib
lua_rawset
lua_type
luaL_argerror
lua_tolstring
lua_concat
lua_isstring
lua_getmetatable
lua_pushstring
lua_pushinteger
luaL_error
luaL_checkoption
luaL_checkinteger
lua_toboolean
luaL_optlstring
lua_pushboolean
lua_pushnil
lua_rawget
lua_pushlstring
luaL_checklstring
luaL_register
lua_newuserdata
lua_error
lua_pushfstring
lua_createtable
lua_pushvalue
lua_setfenv
lua_pushlightuserdata
lua_setfield
lua_gettop
lua_getfenv
lua_getfield
lua_remove
lua_touserdata
lua_isuserdata
lua_settop

msvcrt

rand
sscanf
strstr
_snprintf
localtime
time
_vsnprintf
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
memset
memmove
free
malloc
realloc
memcpy
strlen
memcmp
strcmp

kernel32

QueryPerformanceCounter
Sleep
RtlUnwind
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

Exports

Exports

luaopen_polarssl_havege
luaopen_polarssl_md5
luaopen_polarssl_sha1
luaopen_polarssl_ssl
luaopen_polarssl_strio
luaopen_polarssl_x509parse

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.random.dll
.dll windows:4 windows x86 arch:x86

c3418fea5c4a35d21c73a4c812b6188f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

lua_settable
lua_pushlstring
lua_setfield
lua_pushvalue
luaL_newmetatable
lua_pushfstring
lua_gettop
luaL_checkinteger
lua_pushnumber
luaL_checkudata
lua_newuserdata
lua_setmetatable
lua_getfield
luaL_openlib
luaL_optinteger

msvcrt

_adjust_fdiv
malloc
_initterm
free
floor

kernel32

DisableThreadLibraryCalls

Exports

Exports

luaopen_random

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.rbdhid.dll
.dll windows:5 windows x86 arch:x86

5e72a14b7dddeb79731600a347c8f00a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hid

HidP_GetCaps
HidD_GetPreparsedData
HidD_GetAttributes
HidD_GetHidGuid
HidD_FreePreparsedData

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA

lua51

lua_pushboolean
lua_pushinteger
luaL_checklstring
luaL_register
lua_pushlstring
lua_pushnil

msvcrt

_amsg_exit
_adjust_fdiv
_initterm
memcpy
strcpy
??3@YAXPAX@Z
memset
??2@YAPAXI@Z
free
malloc
_XcptFilter

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
WriteFile
ReadFile
GetLastError
CancelIo
WaitForSingleObject
CreateEventA
CreateFileA
CloseHandle

Exports

Exports

luaopen_rbdhid

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.rex_pcre.dll
.dll windows:4 windows x86 arch:x86

7932e1adbd5236a2704ac8154b863433

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
FindAtomA
GetAtomNameA

msvcrt

__dllonexit
__mb_cur_max
_errno
_iob
_isctype
_pctype
abort
atoi
fflush
fprintf
free
malloc
memcpy
realloc
setlocale
strcpy
toupper

lua51

luaL_argerror
luaL_checklstring
luaL_error
luaL_optinteger
luaL_register
lua_checkstack
lua_createtable
lua_error
lua_getfield
lua_getmetatable
lua_gettable
lua_gettop
lua_isnumber
lua_isstring
lua_newuserdata
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlstring
lua_pushnil
lua_pushstring
lua_pushvalue
lua_rawequal
lua_rawget
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_setfield
lua_setmetatable
lua_settop
lua_toboolean
lua_tointeger
lua_tolstring
lua_touserdata
lua_type
lua_typename

pcre

pcre_compile
pcre_config
pcre_dfa_exec
pcre_exec
pcre_free
pcre_fullinfo
pcre_maketables
pcre_study
pcre_version

Exports

Exports

luaopen_rex_pcre

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 176B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.sapi4.dll
.dll windows:5 windows x86 arch:x86

f18a42917e76205504ddb63ad3c06d8a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\luasapi4\binrel32\serotek.lua51.sapi4.pdb

Imports

luawin

luawin_registercominterface
??1luawin_Gateway_IUnknown@@MAE@XZ
??0luawin_Gateway_IUnknown@@QAE@PAUlua_State@@HPAUIUnknown@@@Z
luawin_gatewaymethod
luawin_registerintconst
luawin_registerguids
luawin_gatewaymethodimplsetup
luawin_gatewaymethodcall
?QueryInterface@luawin_Gateway_IUnknown@@UAGJABU_GUID@@PAPAX@Z
luawin_checkguid
luawin_newcomobjectbox
luawin_pushboxedcomobject
luawin_checkunsigned
luawin_checkiid
luawin_pushguid
luawin_pushwstring
luawin_checklwstring
luawin_checkhr
luawin_initcomsupport
luawin_checkcomobject

lua51

lua_type
luaL_checkinteger
luaL_argerror
luaL_register
luaL_checknumber
lua_settop
lua_pushinteger
lua_newuserdata
lua_pushnumber
lua_setfield
lua_createtable
lua_rawseti

msvcrt

??1type_info@@UAE@XZ
_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
??2@YAPAXI@Z
??3@YAXPAX@Z
memcmp

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

Exports

Exports

luaopen_sapi4

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.socket.core.dll
.dll windows:5 windows x86 arch:x86

c2ac4030ecbee9295989e448aa945b5c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

ioctlsocket
getaddrinfo
freeaddrinfo
recv
closesocket
shutdown
bind
listen
send
accept
connect
getsockopt
socket
select
WSAGetLastError
WSAStartup
WSACleanup
__WSAFDIsSet
setsockopt
getsockname
getpeername
getnameinfo
gethostname

lua51

lua_toboolean
luaL_typerror
lua_typename
lua_setmetatable
lua_rawget
luaL_checkudata
luaL_argerror
lua_pushnumber
lua_tonumber
lua_isnumber
luaL_optnumber
lua_pushnil
luaL_checklstring
lua_gettop
luaL_addlstring
luaL_prepbuffer
lua_replace
lua_pushvalue
luaL_pushresult
luaL_buffinit
luaL_optlstring
lua_insert
lua_settable
lua_pcall
luaL_openlib
luaL_checkinteger
luaL_checknumber
lua_call
lua_newuserdata
lua_getfield
lua_settop
lua_pushcclosure
lua_rawset
lua_createtable
lua_pushstring
luaL_newmetatable
lua_pushfstring
lua_tolstring
lua_touserdata
lua_error
lua_isstring
lua_type
lua_gettable
lua_getmetatable
lua_pushboolean

msvcrt

malloc
free
_initterm
_amsg_exit
_adjust_fdiv
memset
strcmp
atoi
sprintf
_XcptFilter

kernel32

Sleep
RtlUnwind
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersion
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

Exports

Exports

luaopen_socket_core

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.codesign.dll
.dll windows:5 windows x86 arch:x86

ab720c4917373c0e8589822640f90a18

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

luawin

luawin_error
luawin_checklwstring
luawin_pushwstring

lua51

lua_settop
lua_newuserdata
luaL_register

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain

crypt32

CertNameToStrW

msvcrt

free
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
malloc
memset

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind

Exports

Exports

luaopen_stcommon_codesign

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.credhook.dll
.dll windows:5 windows x86 arch:x86

2f77ebd420ecb4759f4a85e14a5badc1

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17/05/2005, 00:00

Not After

16/05/2010, 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

08:78:33:7a:4b:71:9d:d2:1e:4a:15:f3:d0:fb:ba:39
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/11/2008, 00:00

Not After

25/11/2009, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5a:19:6e:09:50:17:ca:bd:1e:31:16:f6:fa:3d:7e:fd:ab:fa:b6:06
Signer

Actual PE Digest

5a:19:6e:09:50:17:ca:bd:1e:31:16:f6:fa:3d:7e:fd:ab:fa:b6:06

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\credhook\lua\binrel32\serotek.lua51.stcommon.credhook.pdb

Imports

luawin

luawin_pushastring
luawin_checklastring
luawin_pushhwnd
luawin_pushwstring
luawin_gatewaymethodcall
luawin_checklwstring
luawin_gatewaymethod
??1luawin_Gateway_IUnknown@@MAE@XZ
??0luawin_Gateway_IUnknown@@QAE@PAUlua_State@@HPAUIUnknown@@@Z
?Release@luawin_Gateway_IUnknown@@UAGKXZ
?AddRef@luawin_Gateway_IUnknown@@UAGKXZ
?QueryInterface@luawin_Gateway_IUnknown@@UAGJABU_GUID@@PAPAX@Z
luawin_registercominterface
luawin_initcomsupport
luawin_registerguids
luawin_checkcomobject
luawin_newcomobjectbox
luawin_checkhr
luawin_pushboxedcomobject
luawin_gatewaymethodimplsetup
luawin_error

lua51

luaL_openlib
lua_pushnil
lua_createtable
lua_setfield
luaL_error
lua_settop
luaL_argerror
lua_type
luaL_checknumber
lua_toboolean
lua_pushboolean
lua_pushnumber

msvcrt

??1type_info@@UAE@XZ
_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
??2@YAPAXI@Z
strncpy
wcsncpy
??3@YAXPAX@Z
memcmp

kernel32

LoadLibraryW
RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress

Exports

Exports

luaopen_stcommon_credhook

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.mmhook.dll
.dll windows:5 windows x86 arch:x86

bdd50d562bffadad74b752864c0b2cb3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

luawin

luawin_error

lua51

lua_settop
luaL_error
luaL_openlib

msvcrt

malloc
free
_initterm
_amsg_exit
_adjust_fdiv
_XcptFilter

kernel32

LoadLibraryA
RtlUnwind
InterlockedExchange
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
GetProcAddress

Exports

Exports

luaopen_stcommon_mmhook

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 946B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.rc.kbdhook.dll
.dll windows:5 windows x86 arch:x86

60cc0a0b3fa20e28b7c483407cba67e1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

luawin

luawin_error

lua51

lua_settop
luaL_register

fbrckbdhook

RemoveFBRCKbdHook
InstallFBRCKbdHook

msvcrt

free
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
malloc

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind

Exports

Exports

luaopen_stcommon_rc_kbdhook

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.rc.shutdown.dll
.dll windows:5 windows x86 arch:x86

27f5120dbf90b988afa36799e8128b81

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\rcshutdown\serotek.lua51.stcommon.rc.shutdown.pdb

Imports

luawin

luawin_error

lua51

luaL_register

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv

kernel32

RtlUnwind
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
CloseHandle

Exports

Exports

luaopen_stcommon_rc_shutdown

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 950B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.reghook.dll
.dll windows:5 windows x86 arch:x86

43d472773837c204eadda31d607e1c31

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17/05/2005, 00:00

Not After

16/05/2010, 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

08:78:33:7a:4b:71:9d:d2:1e:4a:15:f3:d0:fb:ba:39
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/11/2008, 00:00

Not After

25/11/2009, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

00:d8:0d:f0:13:d6:b5:a5:51:22:a5:3d:2c:5e:95:db:b5:3c:a3:eb
Signer

Actual PE Digest

00:d8:0d:f0:13:d6:b5:a5:51:22:a5:3d:2c:5e:95:db:b5:3c:a3:eb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

luawin

luawin_error

lua51

lua_settop
luaL_error
luaL_openlib

msvcrt

_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
free
malloc

kernel32

LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetProcAddress

Exports

Exports

luaopen_stcommon_reghook

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.shfredir.dll
.dll windows:5 windows x86 arch:x86

c9d6685707d61dea9f55f1aa0fcc298e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shfredir

RedirectShellFolderPathW

luawin

luawin_checklwstring

lua51

luaL_checkinteger
lua_settop
luaL_openlib

msvcrt

malloc
free
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetCurrentProcessId

Exports

Exports

luaopen_stcommon_shfredir

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.tones.dll
.dll windows:5 windows x86 arch:x86

058ed411223179fdf9c5af3c15d7ac40

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

lua_settop
luaL_checknumber
luaL_checkinteger
lua_newuserdata
luaL_register
lua_pushlstring

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
sin

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetVersion
SetUnhandledExceptionFilter
UnhandledExceptionFilter

Exports

Exports

luaopen_stcommon_tones

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 950B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stcommon.windows.interdesk.dll
.dll windows:5 windows x86 arch:x86

7b9e6d794a3b2fde1f2d459bf38fcc54

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

luawin

luawin_checklwstring
luawin_checkhwnd
luawin_opthwnd
luawin_checkunsigned

lua51

luaL_register
luaL_checklstring
luaL_checkinteger
lua_toboolean
lua_pushnumber
lua_settop

user32

OpenDesktopW
SetThreadDesktop
IsWindow
SendNotifyMessageW
SendMessageW

msvcrt

_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
malloc
_beginthreadex
free

kernel32

CloseHandle
WaitForSingleObject
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetLastError

Exports

Exports

luaopen_stcommon_windows_interdesk

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stmag.gdi.dll
.dll windows:5 windows x86 arch:x86

f8c64c142a469dd12bf5686724acba29

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

luawin

luawin_pushrect
luawin_error

lua51

luaL_register
lua_settop
luaL_checknumber
luaL_checkinteger
lua_toboolean

stmag_gdi

StMagSetSourceTopLeft
StMagSetNegatingColors
StMagGetSourceRect
StMagSetTrackingCursor
StMagSetFactor
StMagStop
StMagStart

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter

Exports

Exports

luaopen_stmag_gdi

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stmag.magapi.dll
.dll windows:5 windows x86 arch:x86

88a5edee0bac798fb70bb5154008b960

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

luawin

luawin_pushrect
luawin_error

lua51

luaL_register
lua_settop
luaL_checknumber
luaL_checkinteger
lua_toboolean

stmag_magapi

StMagSetSourceTopLeft
StMagSetNegatingColors
StMagGetSourceRect
StMagSetTrackingCursor
StMagSetFactor
StMagStop
StMagStart

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter

Exports

Exports

luaopen_stmag_magapi

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stmag.null.dll
.dll windows:5 windows x86 arch:x86

ae2a3852a92278dfb59aea4af097f849

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\mag\lua\null.pdb

Imports

luawin

luawin_error
luawin_pushrect

lua51

lua_toboolean
lua_settop
luaL_checknumber
luaL_checkinteger
luaL_register

stmag_null

StMagStop
StMagSetFactor
StMagSetSourceTopLeft
StMagSetTrackingCursor
StMagSetNegatingColors
StMagGetSourceRect
StMagStart

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter

Exports

Exports

luaopen_stmag_null

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stsa.nvdacompat.dll
.dll windows:5 windows x86 arch:x86

d428f2019d310ae55209c6f4331f29c2

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17/05/2005, 00:00

Not After

16/05/2010, 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9a:82:20:b2:01:ea:6d:01:c3:01:bf:45:4b:e8:e3:d0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

02/12/2009, 00:00

Not After

02/12/2010, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b0:f6:b8:49:4a:bf:a1:e0:59:23:d8:12:88:07:e8:4b:fa:d6:32:e3
Signer

Actual PE Digest

b0:f6:b8:49:4a:bf:a1:e0:59:23:d8:12:88:07:e8:4b:fa:d6:32:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\nvdacompat\serotek.lua51.stsa.nvdacompat.pdb

Imports

lua51

luaL_register
luaL_error

rpcrt4

RpcMgmtWaitServerListen
RpcServerListen
RpcServerRegisterIf
RpcServerUseProtseqEpW
NdrServerCall2

user32

SendMessageW
IsWindow
GetUserObjectInformationW
GetThreadDesktop
FindWindowW

msvcrt

_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
memset
memcpy
realloc
swprintf
wcslen
malloc
strlen
free

kernel32

GetCurrentProcessId
GetCurrentThreadId
ProcessIdToSessionId
RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
CreateThread

Exports

Exports

luaopen_stsa_nvdacompat

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stscan.camera.dll
.dll windows:5 windows x86 arch:x86

651ef625d0ba04e344ae995c9739bb42

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\lua-camera\serotek.lua51.stscan.camera.pdb

Imports

highgui210

cvCreateCameraCapture
cvReleaseCapture
cvQueryFrame
cvSaveImage

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree

lua51

luaL_register
lua_pushstring
lua_settop
luaL_optinteger
lua_rawseti
luaL_checklstring
lua_createtable

kernel32

GetEnvironmentStrings
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
Sleep
CloseHandle
DeleteCriticalSection
SetEvent
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
CreateEventW
InitializeCriticalSection
GetCurrentThreadId
GetCommandLineA
RtlUnwind
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapFree
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetLocaleInfoA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
RaiseException
GetModuleHandleA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapSize
GetStringTypeA

oleaut32

VariantInit

Exports

Exports

luaopen_stscan_camera

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.stscan.twain.dll
.dll windows:5 windows x86 arch:x86

b4f62c6e374582ea60b9c50cd33fb8df

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

lua_settop
luaL_checkinteger
lua_toboolean
luaL_checklstring
luaL_register
lua_pushboolean

user32

IsWindow
RegisterClassExA
CreateWindowExA
DestroyWindow
GetMessageA
TranslateMessage
DispatchMessageA
PostQuitMessage
DefWindowProcA

msvcrt

_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
memcpy
memset
strcpy

kernel32

CloseHandle
WriteFile
GlobalSize
GlobalLock
OpenFile
GlobalFree
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalAlloc
RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GlobalUnlock

Exports

Exports

luaopen_stscan_twain

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.unicode.dll
.dll windows:4 windows x86 arch:x86

9ace774ba788a998748dbe4326ae76d8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

lua_tolstring
luaL_addvalue
lua_typename
lua_isstring
lua_gettable
lua_replace
lua_pushvalue
lua_type
luaL_checknumber
luaL_openlib
luaL_register
lua_pushcclosure
lua_toboolean
lua_pushnil
luaL_checktype
lua_settop
lua_dump
luaL_error
lua_gettop
luaL_argerror
luaL_checkstack
luaL_buffinit
luaL_prepbuffer
luaL_addlstring
luaL_pushresult
luaL_checkinteger
luaL_optinteger
lua_pushlstring
lua_tointeger
luaL_checklstring
lua_call
lua_pushinteger

msvcrt

_adjust_fdiv
malloc
_initterm
free
strcpy
strchr
strncpy
_ftol
sprintf
strlen
memchr
memcmp
__mb_cur_max
_isctype
_pctype
strpbrk

kernel32

DisableThreadLibraryCalls

Exports

Exports

luaopen_unicode

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.vorbisfile.dll
.dll windows:5 windows x86 arch:x86

980407f64d89bdc539e55a5b01479951

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

luaL_newmetatable
lua_pushvalue
luaL_register
luaL_checklstring
lua_getfield
lua_setmetatable
luaL_checkinteger
lua_newuserdata
lua_pushlstring
luaL_optinteger
lua_createtable
lua_pushinteger
lua_setfield
lua_settop
luaL_argerror
luaL_checkudata

vorbisfile

ov_read
ov_info
ov_clear
ov_open

msvcrt

_wfopen
_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

Exports

Exports

luaopen_vorbisfile

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 1022B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.waveout.dll
.dll windows:5 windows x86 arch:x86

70d096fa7d8bd7b35a9418b157be8d2f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua51

lua_rawgeti
luaL_newmetatable
lua_setfield
luaL_register
lua_tointeger
luaL_checklstring
lua_insert
lua_pushinteger
lua_pushnil
lua_next
lua_pushvalue
lua_rawset
luaL_optinteger
luaL_checkinteger
lua_newuserdata
lua_getfield
lua_setmetatable
lua_createtable
luaL_ref
lua_settop
luaL_unref
luaL_checkudata
luaL_argerror
luaL_error

winmm

waveOutRestart
waveOutGetPosition
waveOutGetErrorTextA
waveOutPause
waveOutPrepareHeader
waveOutWrite
waveOutClose
waveOutReset
waveOutUnprepareHeader
waveOutOpen

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

Exports

Exports

luaopen_waveout

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/serotek.lua51.zip.dll
.dll windows:4 windows x86 arch:x86

f64f43e9a0fa9dcb7521a5b57a17dac3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua5.1

luaL_newmetatable
lua_rawset
luaL_openlib
luaL_optinteger
luaL_checkoption
lua_toboolean
lua_gettop
luaL_checkstack
lua_tonumber
luaL_buffinit
luaL_prepbuffer
luaL_pushresult
lua_rawget
lua_pushcclosure
lua_settable
lua_pushlstring
lua_isstring
lua_createtable
lua_pushvalue
lua_rawseti
lua_replace
lua_type
lua_objlen
lua_rawgeti
lua_pushstring
lua_insert
lua_concat
lua_tolstring
lua_settop
lua_touserdata
luaL_checklstring
lua_newuserdata
lua_getfield
lua_setmetatable
luaL_error
luaL_checkudata
luaL_argerror
lua_pushboolean
lua_pushnil
lua_pushfstring
lua_pushnumber

kernel32

TlsFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
HeapSize
CloseHandle
CreateFileA
GetTimeZoneInformation
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
InitializeCriticalSection
LoadLibraryA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCurrentDirectoryA
GetFullPathNameA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
VirtualAlloc
EnterCriticalSection
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
FindNextFileA
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointer
MultiByteToWideChar
ReadFile
GetFileInformationByHandle
PeekNamedPipe
GetFileType
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
SetEndOfFile
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
Sleep
SetHandleCount
GetStdHandle
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection

Exports

Exports

luaopen_zip

Sections

.text
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/shfredir.dll
.dll windows:4 windows x86 arch:x86

aa8fc96f9cfebe0941d4d338921e750b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

NtSetSystemInformation
NtProtectVirtualMemory
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrGetDllHandle
LdrLoadDll
wcscpy

msvcrt

malloc
_adjust_fdiv
_initterm
__dllonexit
_onexit
_except_handler3
_wcsdup
_stricmp
free

kernel32

GetLastError
LoadLibraryW
Sleep
SetLastError
GetModuleFileNameW

Exports

Exports

RedirectShellFolderPathW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 302B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/atlhostex.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/cjpeg.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/coxpcall.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/credhook.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/expat.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/fb.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/fbcommon.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/fbmedia-common.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/fbsa.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/fbu3.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/jquery.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/keymenu.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lbase64.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lbitlib.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/libjpeg.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lpack.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lpeg.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lrandom.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lrexlib-pcre.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lua-atlhostex.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lua-bz2.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lua-md5.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lua-mpaudec.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lua-polarssl.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lua-sapi4.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lua-vorbisfile.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lua-waveout.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lua-wsapi.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/lua.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/luacom.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/luaexpat.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/luafilesystem.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/luahost.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/luajson.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/luasocket.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/luawin.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/luazip.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/mpaudec.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/ogg.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/pcre.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/reghook.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/shfredir.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/slnunicode.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/spm.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stbrl.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/sths.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stmag-gdi-lua.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stmag-gdi.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stmag-magapi-lua.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stmag-magapi.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stmedialib.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stpdsync.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stsa-inproc-dll.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stsa-inproc-dll32.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stsa-inproc-dll64.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stsa-locale-fr.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stscan-twain.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stscan.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/stupdate.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/vnc-viewer.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/vorbis.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/vorbisfile.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/woemu.json
$LOCALAPPDATA/System Access to Go/SAWebStart/spm/packages/xavante.json
$LOCALAPPDATA/System Access to Go/SAWebStart/stmag_gdi.dll
.dll windows:5 windows x86 arch:x86

93594d4a5b09bce62f691f70d95324dd

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fa:af:50:f0:4d:22:25:4e:ca:92:db:c9:4e:64:75:34:68:4a:1c:c0
Signer

Actual PE Digest

fa:af:50:f0:4d:22:25:4e:ca:92:db:c9:4e:64:75:34:68:4a:1c:c0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\mag\stmag_gdi.pdb

Imports

ddraw

DirectDrawCreateEx

user32

DestroyWindow
UpdateLayeredWindow
SetTimer
SetSystemCursor
GetSystemMetrics
GetCursorPos
SetWindowPos
GetDesktopWindow
DestroyCursor
DefWindowProcA
ReleaseDC
CreateWindowExA
CopyIcon
GetCursorInfo
GetDC
GetIconInfo
DrawIcon
CreateCursor
KillTimer
LoadCursorA
RegisterClassExA

gdi32

SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SetStretchBltMode
StretchBlt
DeleteDC
PatBlt
BitBlt
DeleteObject

msvcrt

malloc
free
_initterm
_amsg_exit
_adjust_fdiv
memset
printf
_XcptFilter

kernel32

InterlockedCompareExchange
Sleep
TerminateProcess
RtlUnwind
SetLastError
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersion
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange

Exports

Exports

StMagGetSourceRect
StMagSetFactor
StMagSetNegatingColors
StMagSetSourceTopLeft
StMagSetTrackingCursor
StMagStart
StMagStop

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/stmag_magapi.dll
.dll windows:5 windows x86 arch:x86

f470d595f56c58eff4a20979997ef45e

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a2:e3:26:9a:7b:1d:68:f8:96:a7:2f:4e:11:46:bd:ed:1b:b2:6e:01
Signer

Actual PE Digest

a2:e3:26:9a:7b:1d:68:f8:96:a7:2f:4e:11:46:bd:ed:1b:b2:6e:01

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\mag\stmag_magapi.pdb

Imports

magnification

MagSetColorEffect
MagUninitialize
MagSetWindowTransform
MagInitialize
MagSetWindowSource

user32

DestroyWindow
UpdateLayeredWindow
SetTimer
SetSystemCursor
RegisterClassExA
KillTimer
CreateCursor
DrawIcon
GetClientRect
UpdateWindow
GetSystemMetrics
SetLayeredWindowAttributes
GetCursorPos
SetWindowPos
GetDesktopWindow
DestroyCursor
DefWindowProcA
ReleaseDC
CreateWindowExA
InvalidateRect
CopyIcon
GetCursorInfo
GetIconInfo
GetDC
LoadCursorA

gdi32

CreateSolidBrush
GetObjectA
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteObject
DeleteDC
PatBlt

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv

kernel32

GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter

Exports

Exports

StMagGetSourceRect
StMagSetFactor
StMagSetNegatingColors
StMagSetSourceTopLeft
StMagSetTrackingCursor
StMagStart
StMagStop

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/stmag_null.dll
.dll windows:5 windows x86 arch:x86

7296c145ed18a3a1e7c77b25bab02ce7

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ec:08:dc:7f:6f:cd:44:4f:98:d4:29:17:2a:3e:d0:62:3d:d0:34:b2
Signer

Actual PE Digest

ec:08:dc:7f:6f:cd:44:4f:98:d4:29:17:2a:3e:d0:62:3d:d0:34:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\mag\stmag_null.pdb

Imports

user32

RegisterClassExA
KillTimer
DefWindowProcA
GetCursorPos
SetTimer
GetSystemMetrics

msvcrt

_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv

kernel32

RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetVersion
SetUnhandledExceptionFilter
UnhandledExceptionFilter

Exports

Exports

StMagGetSourceRect
StMagSetFactor
StMagSetNegatingColors
StMagSetSourceTopLeft
StMagSetTrackingCursor
StMagStart
StMagStop

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/stupdate.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4b:85:73:3d:1f:71:6a:e7:09:b1:1a:e8:c9:df:64:ad:cf:d0:a4:9b
Signer

Actual PE Digest

4b:85:73:3d:1f:71:6a:e7:09:b1:1a:e8:c9:df:64:ad:cf:d0:a4:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 5KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/trayalert.dll
.dll windows:5 windows x86 arch:x86

45eceabe2c3f3af08c5519822d0feb7f

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d9:4a:9a:ef:dc:6d:bd:1e:b7:97:fa:9d:ac:26:e7:55:0c:35:02:f1
Signer

Actual PE Digest

d9:4a:9a:ef:dc:6d:bd:1e:b7:97:fa:9d:ac:26:e7:55:0c:35:02:f1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\serotek\sa\trayalert\trayalert.pdb

Imports

shell32

SHAppBarMessage

user32

GetSystemMetrics
IsWindow
ShowWindow
SetWindowPos
RedrawWindow
SetLastErrorEx
AnimateWindow
GetWindowRect
SystemParametersInfoA

msvcrt

free
_initterm
_amsg_exit
_adjust_fdiv
malloc
_errno
_XcptFilter
memset

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetModuleHandleA
UnhandledExceptionFilter
OutputDebugStringA
GetVersionExA
GetProcAddress

Exports

Exports

ShowWindowFromTray

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/u3/SystemAccessMobile.u3p
.zip
host/procmgr.exe
.exe windows:4 windows x86 arch:x86

13cc68837a3bcd0d5d346e94185798c9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

FindWindowExW
IsWindow
GetWindowThreadProcessId
MessageBoxW
GetMessageW
TranslateMessage
DispatchMessageW
CreateWindowExW
SetWindowLongW
RegisterClassExW
PostMessageW
DestroyWindow
PostQuitMessage
GetWindowLongW
DefWindowProcW

kernel32

UnhandledExceptionFilter
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
ReadFile
SetEndOfFile
SetFilePointer
TerminateProcess
UnregisterWaitEx
CloseHandle
OpenProcess
RegisterWaitForSingleObject
CreateProcessW
WaitForSingleObject
ExitProcess
GetCurrentProcess
HeapFree
GetModuleHandleA
GetStartupInfoW
GetVersion
HeapReAlloc
HeapAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
RtlUnwind
GetLastError
GetModuleFileNameW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
WriteFile
WideCharToMultiByte
CompareStringA
CompareStringW
SetEnvironmentVariableW
SetStdHandle
FlushFileBuffers
CreateFileW
GetProcAddress
LoadLibraryA
GetCPInfo

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
manifest/manifest.u3i
.xml
manifest/serotek.ico
$LOCALAPPDATA/System Access to Go/SAWebStart/u3/cleanup.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

63:2f:6e:ef:19:10:13:1c:4a:e5:95:94:33:7d:33:72:71:54:e9:4a
Signer

Actual PE Digest

63:2f:6e:ef:19:10:13:1c:4a:e5:95:94:33:7d:33:72:71:54:e9:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 60KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/u3/uninstall.exe
.exe windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c2:2a:0e:7f:62:02:ec:ce:a5:7b:f4:9f:66:1d:08:af:1f:91:9c:89
Signer

Actual PE Digest

c2:2a:0e:7f:62:02:ec:ce:a5:7b:f4:9f:66:1d:08:af:1f:91:9c:89

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 17KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/System Access to Go/SAWebStart/u3/wtd.exe
.exe windows:4 windows x86 arch:x86

Code Sign

08:78:33:7a:4b:71:9d:d2:1e:4a:15:f3:d0:fb:ba:39
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/11/2008, 00:00

Not After

25/11/2009, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4d:97:da:c0:91:5d:52:fd:6f:73:64:78:1f:04:46:44:70:0f:1a:56
Signer

Actual PE Digest

4d:97:da:c0:91:5d:52:fd:6f:73:64:78:1f:04:46:44:70:0f:1a:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/uninst.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

08:78:33:7a:4b:71:9d:d2:1e:4a:15:f3:d0:fb:ba:39
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/11/2008, 00:00

Not After

25/11/2009, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

42:da:c7:20:12:a6:6c:53:3c:e4:e8:6e:9b:75:cd:76:57:86:66:68
Signer

Actual PE Digest

42:da:c7:20:12:a6:6c:53:3c:e4:e8:6e:9b:75:cd:76:57:86:66:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

6bc108eed3ca99f68adee56e9c99fac6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynA
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 741B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 657B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 85B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/vncviewer.exe
.exe windows:5 windows x86 arch:x86

c3bb871681974b9078d55aeb28a86454

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/12/2010, 00:00

Not After

10/12/2011, 23:59

Subject

CN=Serotek Corporation,O=Serotek Corporation,POSTALCODE=55403,STREET=Suite 310+STREET=1128 Harmon Place,L=Minneapolis,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e8:ea:f5:24:07:cd:d7:80:1c:d5:31:97:cc:78:54:16:5d:73:1f:36
Signer

Actual PE Digest

e8:ea:f5:24:07:cd:d7:80:1c:d5:31:97:cc:78:54:16:5d:73:1f:36

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

PlaySoundW

ws2_32

WSAGetLastError
WSAEventSelect
closesocket
recv
select
inet_ntoa
getsockname
getpeername
ntohs
shutdown
setsockopt
inet_addr
htons
gethostbyname
connect
WSAStartup
socket
send

comctl32

InitCommonControlsEx
ImageList_Create
_TrackMouseEvent
ImageList_ReplaceIcon

kernel32

UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
FreeLibrary
LoadLibraryW
RemoveDirectoryW
DeleteFileW
SetErrorMode
FindFirstFileW
FindNextFileW
FindClose
GetLogicalDriveStringsW
MoveFileW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetProcAddress
CreateFileW
GetModuleFileNameW
TlsAlloc
WaitForSingleObject
TlsGetValue
GetCurrentThreadId
GetCurrentThread
CreateThread
TlsSetValue
ResumeThread
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageW
WideCharToMultiByte
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeConsole
AllocConsole
FileTimeToSystemTime
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetModuleHandleW
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateEventW
Sleep
GetLastError
ResetEvent
CloseHandle
SetUnhandledExceptionFilter
IsDebuggerPresent
CreateDirectoryW
GetTickCount

user32

GetDC
DrawIcon
SendDlgItemMessageW
EnableWindow
DestroyIcon
LoadMenuW
GetSubMenu
SetMenuDefaultItem
SetForegroundWindow
DrawMenuBar
DestroyMenu
RegisterWindowMessageW
CreateDialogParamW
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
EndDialog
PostMessageW
CreateWindowExW
DestroyWindow
LoadImageW
LoadCursorW
RegisterClassW
SetCursor
BeginPaint
FillRect
DialogBoxParamW
DefWindowProcW
EmptyClipboard
SetClipboardData
GetClipboardOwner
LoadIconW
MessageBoxW
PeekMessageW
DispatchMessageW
EndPaint
MoveWindow
GetAsyncKeyState
OpenClipboard
GetClipboardData
CloseClipboard
ChangeClipboardChain
SetClipboardViewer
IsWindowVisible
ReleaseDC
GetDesktopWindow
SystemParametersInfoW
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetKeyboardState
ToAscii
GetCursorPos
TrackPopupMenu
SendMessageW
GetWindowRect
SetWindowTextW
AdjustWindowRect
SetRect
AdjustWindowRectEx
GetSystemMetrics
SetWindowLongW
SetWindowPos
SetScrollInfo
GetClientRect
ShowCursor
ScrollWindowEx
UnregisterClassW
KillTimer
SetTimer
EnableMenuItem
CheckMenuItem
ModifyMenuW
InsertMenuW
RemoveMenu
InvalidateRect
UpdateWindow
GetUpdateRect
GetWindowLongW
GetSystemMenu
AppendMenuW
ShowWindow
MessageBeep
MsgWaitForMultipleObjects
GetForegroundWindow
GetClassNameW
IsDialogMessageW
TranslateMessage

gdi32

SetPaletteEntries
BitBlt
UnrealizeObject
ResizePalette
RealizePalette
GetStockObject
CreateDIBSection
GetObjectW
SetDIBColorTable
SelectObject
CreateCompatibleDC
DeleteDC
GetDIBits
CreateCompatibleBitmap
DeleteObject
SelectPalette
CreatePalette

msvcr90

__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_vsnprintf
_configthreadlocale
_except_handler4_common
_invoke_watson
_controlfp_s
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__setusermatherr
_strdup
_crt_debugger_hook
??3@YAXPAX@Z
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
__CxxFrameHandler3
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_purecall
wcscmp
_CxxThrowException
??2@YAPAXI@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
_swprintf
wcslen
atoi
sprintf
strlen
wcscat
wcscpy
memcpy
abs
memcmp
ceil
printf
strcmp
strcpy
wcsrchr
_vsnwprintf
wcsncpy
_wcsicmp
exit
getchar
wprintf
_stricmp
setbuf
freopen
__iob_func
__argc
__argv
strncat
_ftime64
memmove
memset
strrchr
wcscspn
free
strncpy
_strnicmp
strchr
fprintf
sscanf
floor
fopen
fclose
qsort
ferror
fwrite
fread
_initterm_e
_time64
fflush
rename
remove
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_ctime64

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

libjpeg

jpeg_finish_compress
jpeg_write_scanlines
jpeg_start_compress
jpeg_set_quality
jpeg_set_defaults
jpeg_CreateCompress
jpeg_std_error
jpeg_resync_to_restart
jpeg_destroy_decompress
jpeg_finish_decompress
jpeg_read_scanlines
jpeg_start_decompress
jpeg_read_header
jpeg_CreateDecompress
jpeg_destroy_compress

shell32

DragQueryFileW

zlib1

deflateParams
deflate
deflateEnd
inflateInit_
inflateEnd
inflate
deflateInit_

Sections

.text
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/vorbis.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

_analysis_output_always
_floor_P
_mapping_P
_residue_P
vorbis_analysis
vorbis_analysis_blockout
vorbis_analysis_buffer
vorbis_analysis_headerout
vorbis_analysis_init
vorbis_analysis_wrote
vorbis_bitrate_addblock
vorbis_bitrate_flushpacket
vorbis_block_clear
vorbis_block_init
vorbis_comment_add
vorbis_comment_add_tag
vorbis_comment_clear
vorbis_comment_init
vorbis_comment_query
vorbis_comment_query_count
vorbis_commentheader_out
vorbis_dsp_clear
vorbis_granule_time
vorbis_info_blocksize
vorbis_info_clear
vorbis_info_init
vorbis_packet_blocksize
vorbis_synthesis
vorbis_synthesis_blockin
vorbis_synthesis_halfrate
vorbis_synthesis_halfrate_p
vorbis_synthesis_headerin
vorbis_synthesis_init
vorbis_synthesis_lapout
vorbis_synthesis_pcmout
vorbis_synthesis_read
vorbis_synthesis_restart
vorbis_synthesis_trackonly
vorbis_window

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/vorbisfile.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ov_bitrate
ov_bitrate_instant
ov_clear
ov_comment
ov_crosslap
ov_halfrate
ov_halfrate_p
ov_info
ov_open
ov_open_callbacks
ov_pcm_seek
ov_pcm_seek_lap
ov_pcm_seek_page
ov_pcm_seek_page_lap
ov_pcm_tell
ov_pcm_total
ov_raw_seek
ov_raw_seek_lap
ov_raw_tell
ov_raw_total
ov_read
ov_read_float
ov_seekable
ov_serialnumber
ov_streams
ov_test
ov_test_callbacks
ov_test_open
ov_time_seek
ov_time_seek_lap
ov_time_seek_page
ov_time_seek_page_lap
ov_time_tell
ov_time_total

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 286B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/System Access to Go/SAWebStart/woemu.dll
.dll windows:4 windows x86 arch:x86

4b23b2d24eaf4cec502aad180ff36ab2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

dsound

ord1
ord2

kernel32

HeapAlloc
GetProcessHeap
HeapFree
DeleteCriticalSection
CloseHandle
WaitForSingleObject
SetThreadPriority
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetEvent
Beep
WaitForMultipleObjects
GetSystemInfo
RaiseException
RtlUnwind
ExitThread
GetCurrentThreadId
GetLastError
CreateThread
GetCommandLineA
GetVersionExA
SetUnhandledExceptionFilter
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
InterlockedExchange
VirtualQuery
LoadLibraryA
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect

user32

PostThreadMessageA
PostMessageA
GetDesktopWindow

Exports

Exports

waveOutClose
waveOutGetDevCapsA
waveOutGetID
waveOutGetNumDevs
waveOutGetPosition
waveOutGetVolume
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutSetVolume
waveOutUnprepareHeader
waveOutWrite

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0Certificate

Extended Key Usages

Key Usages

13:4b:0a:06:63:ae:fe:a1:67:22:12:d9:c2:0a:37:7a:84:1b:e5:ebSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 32KB

.rsrc Size: 3KB - Virtual size: 2KB

09d0478591d4f788cb3e5ea416c25237

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0Certificate

Extended Key Usages

Key Usages

46:45:ce:d7:db:d5:87:80:32:c8:f9:c0:d1:b4:f6:92:71:74:c2:2cSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 6KB - Virtual size: 24KB

.rsrc Size: 8KB - Virtual size: 8KB

12b063f0d89b324ad175d8c294462144

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0Certificate

Extended Key Usages

Key Usages

c9:3c:dc:be:b9:3f:a2:00:ca:e8:ac:16:62:85:e8:5a:b9:ea:d1:c6Signer

Headers

File Characteristics

PDB Paths

Imports

user32

msvcrt

kernel32

ntdll

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

362cc361578d2309461a0b9f4948338c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

13:4b:0a:06:63:ae:fe:a1:67:22:12:d9:c2:0a:37:7a:84:1b:e5:eb
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 32KB

.rsrc
Size: 3KB - Virtual size: 2KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

46:45:ce:d7:db:d5:87:80:32:c8:f9:c0:d1:b4:f6:92:71:74:c2:2c
Signer

.text
Size: 6KB - Virtual size: 24KB

.rsrc
Size: 8KB - Virtual size: 8KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

c9:3c:dc:be:b9:3f:a2:00:ca:e8:ac:16:62:85:e8:5a:b9:ea:d1:c6
Signer

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 42KB - Virtual size: 41KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 10KB

.reloc
Size: 5KB - Virtual size: 5KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

27:2a:c6:67:d3:a0:fc:1b:5b:dc:94:5c:b7:4a:40:65:9a:76:27:6a
Signer

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 6KB - Virtual size: 6KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

50:ab:f1:ab:94:4c:8f:20:dc:7e:6a:96:0a:ce:60:da:b3:6b:0b:da
Signer

.text
Size: 5KB - Virtual size: 20KB

.rsrc
Size: 7KB - Virtual size: 8KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:bb:0b:72:18:4e:df:3a:53:89:82:06:2e:c8:29:e0
Certificate

cc:b4:09:14:e4:2f:e9:35:32:4a:fe:32:f0:46:bd:d1:18:b5:6c:f5
Signer

.text
Size: 6KB - Virtual size: 24KB

.rsrc
Size: 7KB - Virtual size: 8KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate